Detection.FYI

Remote Access Tool Services Have Been Installed - Security

Dec 7, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 ·

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Modification or Deletion of an AWS RDS Cluster

Dec 6, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

NetNTLM Downgrade Attack - Registry

Dec 3, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Always Install Elevated Windows Installer

Dec 1, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Exploiting CVE-2019-1388

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2019-1388 detection.emerging-threats ·

Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Permission Check Via Accesschk.EXE

Dec 1, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Potential CVE-2021-41379 Exploitation Attempt

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2021-41379 detection.emerging-threats ·

Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Potential Privilege Escalation via Service Permissions Weakness

Dec 1, 2024 · attack.privilege-escalation attack.t1574.011 ·

Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·

Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Suspicious Child Process Created as System

Dec 1, 2024 · attack.privilege-escalation attack.t1134.002 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Suspicious Process By Web Server Process

Dec 1, 2024 · attack.persistence attack.t1505.003 attack.t1190 ·

Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Suspicious RazerInstaller Explorer Subprocess

Dec 1, 2024 · attack.privilege-escalation attack.t1553 detection.emerging-threats ·

Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·

Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·

Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Password Policy Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1201 ·

Share on:

Detects password policy discovery commands

File and Directory Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

System Owner or User Discovery - Linux

Dec 1, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

COM Object Hijacking Via Modification Of Default System CLSID Default Value

Dec 1, 2024 · attack.persistence attack.t1546.015 ·

Share on:

Detects potential COM object hijacking via modification of default system CLSID.

All Rules Have Been Deleted From The Windows Firewall Configuration

Dec 1, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Dec 1, 2024 · detection.emerging-threats attack.execution attack.t1203 cve.2023-38331 ·

Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

GCP Access Policy Deleted

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·

Share on:

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

GCP Break-glass Container Workload Deployed

Dec 1, 2024 · attack.defense-evasion attack.t1548 ·

Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Google Workspace Application Access Level Modified

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·

Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

HackTool - EDRSilencer Execution - Filter Added

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

HackTool - SharpMove Tool Execution

Dec 1, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

HackTool - SOAPHound Execution

Dec 1, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Malicious PowerShell Commandlets - ProcessCreation

Dec 1, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Peach Sandstorm APT Process Activity Indicators

Dec 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects process creation activity related to Peach Sandstorm APT

Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Dec 1, 2024 · detection.emerging-threats attack.defense-evasion attack.execution ·

Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Potential Dropper Script Execution Via WScript/CScript

Dec 1, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects wscript/cscript executions of scripts located in user directories

Potential Peach Sandstorm APT C2 Communication Activity

Dec 1, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication activity related to Peach Sandstorm APT

Potential Persistence Via MyComputer Registry Keys

Dec 1, 2024 · attack.persistence ·

Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Potential Pikabot C2 Activity

Dec 1, 2024 · attack.command-and-control attack.t1573 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Potential Pikabot Discovery Activity

Dec 1, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·

Share on:

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Potential Pikabot Hollowing Activity

Dec 1, 2024 · attack.defense-evasion attack.t1055.012 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Potentially Suspicious Self Extraction Directive File Created

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.

PowerShell Core DLL Loaded By Non PowerShell Process

Dec 1, 2024 · attack.t1059.001 attack.execution ·

Share on:

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Remote Thread Creation In Mstsc.Exe From Suspicious Location

Dec 1, 2024 · attack.credential-access ·

Share on:

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Self Extraction Directive File Created In Potentially Suspicious Location

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.

Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

System Control Panel Item Loaded From Uncommon Location

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

System Disk And Volume Reconnaissance Via Wmic.EXE

Dec 1, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·

Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Uncommon Connection to Active Directory Web Services

Dec 1, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Creation of WerFault.exe/Wer.dll in Unusual Folder

Nov 29, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

GALLIUM IOCs

Nov 25, 2024 · attack.credential-access attack.command-and-control attack.t1212 attack.t1071 attack.g0093 detection.emerging-threats ·

Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

HackTool - CreateMiniDump Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution GMER tool based on image and hash fields.

HackTool - HandleKatz LSASS Dumper Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·

Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·

Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

HackTool - SharpEvtMute DLL Load

Nov 25, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·

Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·

Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

HackTool - Windows Credential Editor (WCE) Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·

Share on:

Detects the use of Windows Credential Editor (WCE)

Hacktool Execution - Imphash

Nov 25, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

HackTool Named File Stream Created

Nov 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Malicious DLL Load By Compromised 3CXDesktopApp

Nov 25, 2024 · attack.defense-evasion detection.emerging-threats ·

Share on:

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Potential Compromised 3CXDesktopApp Execution

Nov 25, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·

Share on:

Detects execution of known compromised version of 3CXDesktopApp

Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

PUA - Nimgrab Execution

Nov 25, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

PUA - Process Hacker Driver Load

Nov 25, 2024 · attack.privilege-escalation cve.2021-21551 attack.t1543 ·

Share on:

Detects driver load of the Process Hacker tool

PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

PUA - System Informer Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects driver load of the System Informer tool

PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Renamed AdFind Execution

Nov 25, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Vulnerable HackSys Extreme Vulnerable Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Vulnerable WinRing0 Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

WinDivert Driver Load

Nov 25, 2024 · attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·

Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

ESXi Account Creation Via ESXCLI

Nov 20, 2024 · attack.persistence attack.t1136 ·

Share on:

Detects user account creation on ESXi system via esxcli

ESXi Admin Permission Assigned To Account Via ESXCLI

Nov 20, 2024 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

ESXi Network Configuration Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi Syslog Configuration Change Via ESXCLI

Nov 20, 2024 · attack.defense-evasion attack.t1562.001 attack.t1562.003 ·

Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

ESXi System Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM Kill Via ESXCLI

Nov 20, 2024 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

ESXi VM List Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

App Assigned To Azure RBAC/Microsoft Entra Role

Nov 20, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·

Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·

Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Python Reverse Shell Execution Via PTY And Socket Modules

Nov 4, 2024 · attack.execution ·

Share on:

Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.

Python Spawning Pretty TTY Via PTY Module

Nov 4, 2024 · attack.execution attack.t1059 ·

Share on:

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

Antivirus Exploitation Framework Detection

Nov 4, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·

Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Hacktool Detection

Nov 4, 2024 · attack.execution attack.t1204 ·

Share on:

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Password Dumper Detection

Nov 4, 2024 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Ransomware Detection

Nov 4, 2024 · attack.t1486 ·

Share on:

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Relevant File Paths Alerts

Nov 4, 2024 · attack.resource-development attack.t1588 ·

Share on:

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Web Shell Detection

Nov 4, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·

Share on:

Detects suspicious DNS queries to Monero mining pools

.RDP File Created by Outlook Process

Nov 4, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use RDP files as attachments.

Paste sharing url in reverse order

Nov 4, 2024 ·

Share on:

Paste sharing url in reverse order

Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Nov 1, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

.RDP File Created By Uncommon Application

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Cloudflared Tunnels Related DNS Requests

Nov 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Compressed File Creation Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Compressed File Extraction Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Cscript/Wscript Potentially Suspicious Child Process

Nov 1, 2024 · attack.execution ·

Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

DLL Names Used By SVR For GraphicalProton Backdoor

Nov 1, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Hunts known SVR-specific DLL names.

Enable LM Hash Storage

Nov 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Firewall Configuration Discovery Via Netsh.EXE

Nov 1, 2024 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

HackTool - NoFilter Execution

Nov 1, 2024 · attack.privilege-escalation attack.t1134 attack.t1134.001 ·

Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Potential Base64 Decoded From Images

Nov 1, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Potential Direct Syscall of NtOpenProcess

Nov 1, 2024 · attack.execution attack.t1106 ·

Share on:

Detects potential calls to NtOpenProcess directly from NTDLL.

Potential Persistence Via AppCompat RegisterAppRestart Layer

Nov 1, 2024 · attack.persistence attack.t1546.011 ·

Share on:

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Nov 1, 2024 · attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·

Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Potential PowerShell Execution Policy Tampering

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Potentially Suspicious AccessMask Requested From LSASS

Nov 1, 2024 · attack.credential-access car.2019-04-004 attack.t1003.001 ·

Share on:

Detects process handle on LSASS process with certain access mask

Potentially Suspicious Command Targeting Teams Sensitive Files

Nov 1, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Potentially Suspicious Desktop Background Change Via Registry

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

PSScriptPolicyTest Creation By Uncommon Process

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of a renamed "cloudflared" binary.

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

Nov 1, 2024 · attack.persistence ·

Share on:

Hunts for known SVR-specific scheduled task names

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler

Nov 1, 2024 · attack.persistence ·

Share on:

Hunts for known SVR-specific scheduled task names

Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Suspicious Greedy Compression Using Rar.EXE

Nov 1, 2024 · attack.execution attack.t1059 ·

Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·

Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

System Information Discovery Using Ioreg

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

System Information Discovery Using sw_vers

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of "sw_vers" for system information discovery

System Information Discovery Using System_Profiler

Nov 1, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·

Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

System Integrity Protection (SIP) Disabled

Nov 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.

System Integrity Protection (SIP) Enumeration

Nov 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.

Tamper Windows Defender - PSClassic

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Tamper Windows Defender - ScriptBlockLogging

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Uncommon File Created In Office Startup Folder

Nov 1, 2024 · attack.resource-development attack.t1587.001 ·

Share on:

Detects the creation of a file with an uncommon extension in an Office application startup folder

Uncommon System Information Discovery Via Wmic.EXE

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

BITS Transfer Job Download From File Sharing Domains

Oct 25, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Oct 25, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

New Connection Initiated To Potential Dead Drop Resolver Domain

Oct 25, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·

Share on:

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Suspicious File Download From File Sharing Domain Via Curl.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Suspicious File Download From File Sharing Domain Via Wget.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Suspicious File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Suspicious Windows Service Tampering

Oct 25, 2024 · attack.defense-evasion attack.t1489 ·

Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Unusual File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Oct 8, 2024 · attack.execution ·

Share on:

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Renamed Powershell Under Powershell Channel

Oct 8, 2024 · attack.execution attack.t1059.001 attack.t1036.003 ·

Share on:

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Suspicious Non PowerShell WSMAN COM Provider

Oct 8, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

HackTool - Certipy Execution

Oct 8, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Share on:

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Alternate PowerShell Hosts Pipe

Oct 8, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Local System Accounts Discovery - Linux

Oct 8, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Disable Windows Defender Functionalities Via Registry Keys

Oct 8, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

LSASS Process Memory Dump Files

Oct 8, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Potentially Suspicious JWT Token Search Via CLI

Oct 6, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Potential Python DLL SideLoading

Oct 6, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of Python DLL files.

ETW Logging/Processing Option Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·

Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

HTTP Logging Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·

Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

New Module Module Added To IIS Server

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·

Share on:

Detects the addition of a new module to an IIS server.

Previously Installed IIS Module Was Removed

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·

Share on:

Detects the removal of a previously installed IIS module.

Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new potentially suspicious download sources

Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·

Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Oct 1, 2024 · detection.emerging-threats attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Oct 1, 2024 · detection.emerging-threats attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-46747 Exploitation Activity - Proxy

Oct 1, 2024 · attack.initial-access attack.t1190 detection.emerging-threats cve.2023-46747 ·

Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

CVE-2023-46747 Exploitation Activity - Webserver

Oct 1, 2024 · attack.initial-access attack.t1190 detection.emerging-threats cve.2023-46747 ·

Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·

Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·

Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·

Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Oct 1, 2024 · detection.emerging-threats attack.initial-access attack.t1190 cve.2023-4966 ·

Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

Disable Internal Tools or Feature in Registry

Oct 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

DNS Query To Devtunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

DNS Query To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Elevated System Shell Spawned From Uncommon Parent Location

Oct 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·

Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·

Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Oct 1, 2024 · cve.2023-46214 detection.emerging-threats attack.lateral-movement attack.t1210 ·

Share on:

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

F5 BIG-IP iControl Rest API Command Execution - Proxy

Oct 1, 2024 · attack.initial-access attack.t1190 ·

Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

F5 BIG-IP iControl Rest API Command Execution - Webserver

Oct 1, 2024 · attack.execution attack.t1190 ·

Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

HackTool - Generic Process Access

Oct 1, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects process access requests from hacktool processes based on their default image name

HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Important Windows Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·

Share on:

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Lace Tempest Cobalt Strike Download

Oct 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

Lace Tempest File Indicators

Oct 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

Lace Tempest Malware Loader Execution

Oct 1, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

Lace Tempest PowerShell Evidence Eraser

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

Lace Tempest PowerShell Launcher

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

Load Of RstrtMgr.DLL By A Suspicious Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Load Of RstrtMgr.DLL By An Uncommon Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Malicious Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects loading of known malicious drivers via their hash.

Malicious Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Network Connection Initiated To DevTunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Network Connection Initiated To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

New Netsh Helper DLL Registered From A Suspicious Location

Oct 1, 2024 · attack.persistence attack.t1546.007 ·

Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Permission Misconfiguration Reconnaissance Via Findstr.EXE

Oct 1, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Portable Gpg.EXE Execution

Oct 1, 2024 · attack.impact attack.t1486 ·

Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Potential CVE-2023-46214 Exploitation Attempt

Oct 1, 2024 · attack.lateral-movement attack.t1210 cve.2023-46214 detection.emerging-threats ·

Share on:

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Oct 1, 2024 · attack.t1021.003 attack.lateral-movement ·

Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Potential Linux Process Code Injection Via DD Utility

Oct 1, 2024 · attack.defense-evasion attack.t1055.009 ·

Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Potential Persistence Via Netsh Helper DLL - Registry

Oct 1, 2024 · attack.persistence attack.t1546.007 ·

Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·

Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Potentially Suspicious Electron Application CommandLine

Oct 1, 2024 · attack.execution ·

Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Potentially Suspicious GrantedAccess Flags On LSASS

Oct 1, 2024 · attack.credential-access attack.t1003.001 attack.s0002 ·

Share on:

Detects process access requests to LSASS process with potentially suspicious access flags

PowerShell Execution With Potential Decryption Capabilities

Oct 1, 2024 · attack.execution ·

Share on:

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Remote Thread Creation Via PowerShell In Uncommon Target

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 ·

Share on:

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Security Tools Keyword Lookup Via Findstr.EXE

Oct 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Suspicious Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·

Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Suspicious Path In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Suspicious Shim Database Patching Activity

Oct 1, 2024 · attack.persistence attack.t1546.011 ·

Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Uncommon Extension In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Unusual Parent Process For Cmd.EXE

Oct 1, 2024 · attack.execution attack.t1059 ·

Share on:

Detects suspicious parent process for cmd.exe

Vulnerable Driver Load

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects loading of known vulnerable drivers via their hash.

Vulnerable Driver Load By Name

Oct 1, 2024 · attack.privilege-escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Whoami.EXE Execution Anomaly

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·

Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Whoami.EXE Execution With Output Option

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Linux HackTool Execution

Sep 22, 2024 · attack.execution attack.resource-development attack.t1587 ·

Share on:

Detects known hacktool execution based on image name.

Linux Network Service Scanning Tools Execution

Sep 22, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Windows Defender Exclusion Registry Key - Write Access Requested

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

Windows Defender Real-time Protection Disabled

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Detect MeshAgent Command Execution via MeshCentral

Sep 21, 2024 · attack.command_and_control attack.t1219 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Search for Antivirus process

Sep 20, 2024 ·

Share on:

Search for Antivirus process

DNS Query To Remote Access Software Domain From Non-Browser App

Sep 13, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Network Connection Initiated To BTunnels Domains

Sep 13, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

PwnKit Local Privilege Escalation

Sep 13, 2024 · attack.privilege-escalation attack.t1548.001 ·

Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

UNC2452 Process Creation Patterns

Sep 13, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·

Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·

Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Sep 13, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·

Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

LPE InstallerFileTakeOver PoC CVE-2021-41379

Sep 13, 2024 · attack.initial-access attack.t1190 detection.emerging-threats ·

Share on:

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Malicious PowerShell Scripts - FileCreation

Sep 13, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of known offensive powershell scripts used for exploitation

Malicious PowerShell Scripts - PoshModule

Sep 13, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Possible CVE-2021-1675 Print Spooler Exploitation

Sep 13, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·

Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·

Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Potential RDP Exploit CVE-2019-0708

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Potential SAM Database Dump

Sep 13, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Suspicious Rejected SMB Guest Logon From IP

Sep 13, 2024 · attack.credential-access attack.t1110.001 ·

Share on:

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·

Share on:

Detect DLL Load from Spooler Service backup folder

Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Cicada3301 Ransomware Execution via PSExec

Sep 9, 2024 · attack.execution attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of a potentially-renamed psexec to run the Cicada3301 ransomware tool.

Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·

Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·

Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·

Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Startup/Logon Script Added to Group Policy Object

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 attack.t1547 ·

Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Persistence and Execution at Scale via GPO Scheduled Task

Sep 6, 2024 · attack.persistence attack.lateral-movement attack.t1053.005 ·

Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Group Policy Abuse for Privilege Addition

Sep 6, 2024 · attack.privilege-escalation attack.t1484.001 ·

Share on:

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Process Deletion of Its Own Executable

Sep 3, 2024 · attack.defense-evasion ·

Share on:

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

PowerShell Web Access Feature Enabled Via DISM

Sep 3, 2024 · attack.persistence attack.t1548.002 ·

Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

PowerShell Web Access Installation - PsScript

Sep 3, 2024 · attack.persistence attack.t1059.001 ·

Share on:

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

Remote Access Tool - AnyDesk Incoming Connection

Sep 2, 2024 · attack.persistence attack.command-and-control attack.t1219 ·

Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Capsh Shell Invocation - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "capsh" utility to invoke a shell.

Inline Python Execution - Spawn Shell Via OS System Library

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

Shell Execution GCC - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Find - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Shell Execution via Flock - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Git - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Nice - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Execution via Rsync - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Invocation via Apt - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Shell Invocation via Env Command - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Shell Invocation Via Ssh - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Suspicious Invocation of Shell via AWK - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Vim GTFOBin Abuse - Linux

Sep 2, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

AWS S3 Bucket Versioning Disable

Sep 2, 2024 · attack.impact attack.t1490 ·

Share on:

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Certificate Use With No Strong Mapping

Sep 2, 2024 · attack.privilege-escalation ·

Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

ChromeLoader Malware Execution

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·

Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

DarkGate - Autoit3.EXE Execution Parameters

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

DarkGate - User Created Via Net.EXE

Sep 2, 2024 · attack.persistence attack.t1136.001 detection.emerging-threats ·

Share on:

Detects creation of local users via the net.exe command with the name of "DarkGate"

Diamond Sleet APT DLL Sideloading Indicators

Sep 2, 2024 · attack.defense-evasion attack.t1574.002 detection.emerging-threats ·

Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Diamond Sleet APT DNS Communication Indicators

Sep 2, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects DNS queries related to Diamond Sleet APT activity

Diamond Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects file creation activity that is related to Diamond Sleet APT activity

Diamond Sleet APT Process Activity Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects process creation activity indicators related to Diamond Sleet APT

Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Diamond Sleet APT Scheduled Task Creation - Registry

Sep 2, 2024 · attack.defense-evasion attack.t1562 detection.emerging-threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC

Sep 2, 2024 · attack.execution attack.lateral-movement attack.t1210 cve.2020-1472 detection.emerging-threats ·

Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Exploitation Indicators Of CVE-2023-20198

Sep 2, 2024 · attack.privilege-escalation attack.initial-access detection.emerging-threats ·

Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·

Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

File Download From IP URL Via Curl.EXE

Sep 2, 2024 · attack.execution ·

Share on:

Detects file downloads directly from IP address URL using curl.exe

HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Injected Browser Process Spawning Rundll32 - GuLoader Activity

Sep 2, 2024 · attack.defense-evasion attack.t1055 detection.emerging-threats ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Kerberoasting Activity - Initial Query

Sep 2, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

LSASS Process Memory Dump Creation Via Taskmgr.EXE

Sep 2, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

New Okta User Created

Sep 2, 2024 · attack.credential-access ·

Share on:

Detects new user account creation

Obfuscated IP Via CLI

Sep 2, 2024 · attack.discovery ·

Share on:

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

Obfuscated PowerShell OneLiner Execution

Sep 2, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·

Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Okta 2023 Breach Indicator Of Compromise

Sep 2, 2024 · attack.credential-access detection.emerging-threats ·

Share on:

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

Okta Admin Functions Access Through Proxy

Sep 2, 2024 · attack.credential-access ·

Share on:

Detects access to Okta admin functions through proxy.

OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Onyx Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects file creation activity that is related to Onyx Sleet APT activity

Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon

Sep 2, 2024 · attack.initial-access attack.t1190 cve.2021-44228 detection.emerging-threats ·

Share on:

Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.

Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution

Sep 2, 2024 · attack.execution attack.initial-access attack.t1059.006 attack.t1190 cve.2022-22954 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Sep 2, 2024 · attack.persistence attack.t1505.001 cve.2023-27363 detection.emerging-threats ·

Share on:

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Sep 2, 2024 · attack.execution cve.2023-36874 detection.emerging-threats ·

Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Sep 2, 2024 · attack.defense-evasion ·

Share on: