2022_HTMLSmuggling

ISO Image Mount

Dec 28, 2022 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the mount of ISO images on an endpoint

ISO, VHD, LNK or IMG File Extracted from Zip (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 attack.t1564 ·

Share on:

Detects extraction of ISO, VHD, LNK, or IMG files from zip files. Commonly associated with QakBot and IcedID.

Suspicious User-Initiated Process Execution on External Drive (Old)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Suspicious User-Initiated Process Execution on External Drive (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Web Browser Creates Zip Archive File (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 ·

Share on:

Detects browser applications creating archive/container files such as zip, rar, or 7z, as occurs during an HTML smuggling attack where a browser decodes and executes malicious code within an HTML file. Commonly associated with QakBot and IcedID.