2023_RedCanary_ThreatDetectionReport

QBot rundll32.exe Non-standard File Proxy Execution (RedCanary Threat Detection Report)

Jun 2, 2023 · attack.s0650 ·

Detects Rundll32.exe process creations with non-standard file types denoted by excluding the common file types from the command-=line selection. Part of the RedCanary 2023 Threat Detection Report.

BITSAdmin Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using bitsadmin.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Certutil Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using certutil.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Emotet: Regsvr32 Execution from Microsoft Excel (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0367 ·

Share on:

Detects Regsvr32 execution from Excel, a technique associated with Emotet. Part of the RedCanary 2023 Threat Detection Report.

Gootloader JavaScript Execution in AppData Folder (RedCanary Threat Detection Report)

May 17, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects execution of JavaScript (.js) files located in the AppData folder. Part of the RedCanary 2023 Threat Detection Report.

Impacket SMBexec.py Execution (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0357 ·

Share on:

Detects execution from Impacket's smbexec.py. Part of the RedCanary 2023 Threat Detection Report.

Impacket WMIExec.py Execution (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0357 ·

Share on:

Detects execution from Impacket's wmiexec.py. Part of the RedCanary 2023 Threat Detection Report.

Abnormal LSASS Child and Parent Process Relationships (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects potential LSASS abuse based on unusual parent-child process lineage patterns. Part of the RedCanary 2023 Threat Detection Report.

Abnormal LSASS Process Access and Injection (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects suspicious cross-process events where LSASS is accessed. Part of the RedCanary 2023 Threat Detection Report.

AdSearch Reg Runkey Persistence Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects registry modifications to CurrentVersion\Run key, associated with AdSearch. Part of the RedCanary 2023 Threat Detection Report.

AdSearch Startup Folder Persistence File Creation (RedCanary Threat Detection Report)

May 10, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects file creations by cscript in the startup folder, associated with AdSearch. Part of the RedCanary 2023 Threat Detection Report.

Cobalt Strike Beacon Getsystem Pattern (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·

Share on:

Detects command line pattern indicating the use of Cobalt Strike GetSystem feature. Part of the RedCanary 2023 Threat Detection Report.

Cobalt Strike Beacon Implant Command Issued via Named Pipe (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·

Share on:

Detects named pipe creation indicating Cobalt Strike beacon implant issuing commands via SMB named pipe. Part of the RedCanary 2023 Threat Detection Report.

Cobalt Strike UAC Bypass Using SQL Server Client Configuration Utility (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·

Share on:

Detects a possible Cobalt Strike UAC bypass attempt using cliconfg.exe, the SQL Server Client Configuration Utility. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Bypassing Security Controls (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects command line strings which indicate potential attempts to bypass controls. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Suspicious Process Ancestry (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects IIS worker process spawning command shell. Part of the RedCanary 2023 Threat Detection Report.

Common BloodHound Command-Line Options (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0521 ·

Share on:

Detects common BloodHound parameters in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Default Impacket Service Creation Via Registry Keys (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects registry key creation matching default Impacket default naming convention. Part of the RedCanary 2023 Threat Detection Report.

Explorer Spawning CMD With Start/Exit Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2023 Threat Detection Report.

File Writes Within Admin Shares (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects files written to an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.

Impacket Atexec.py Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0357 ·

Share on:

Detects execution from Impacket's atexec.py. Part of the RedCanary 2023 Threat Detection Report.

ISO File Write to Suspicious Folder (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1553.005 ·

Share on:

Detects files written to user downloads folder or appdata folder, associated with Mark-of-the-Web Bypass. Part of the RedCanary 2023 Threat Detection Report.

LSASS Running Under Non-Privileged User Context (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects instances of LSASS running under any non-privileged user context, which can indicate abuse. Part of the RedCanary 2023 Threat Detection Report.

Mimikatz .kirbi File Creation (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0002 ·

Share on:

Detects .kirbi files created, commonly associated with Mimikatz. Part of the RedCanary 2023 Threat Detection Report.

Mimikatz Module Names in Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0002 ·

Share on:

Detects presence of common Mimikatz module names in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Office Products Spawning WMI (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects MS Office applications spawning WMI processes. Part of the RedCanary 2023 Threat Detection Report.

PlugX DLL Search Order Hijacking Using Avast wsc_proxy (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0013 ·

Share on:

Detects possible DLL Search Order hijacking using Avast antivirus wsc_proxy application. This technique is associated with PlugX. Part of the RedCanary 2023 Threat Detection Report.

Possible Raspberry Robin DLL Download Using msiexec (RedCanary Threat Detection Report)

May 10, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects msiexec used to download a potentially-malicious Raspberry Robin DLL. Part of the RedCanary 2023 Threat Detection Report.

Potential Gamarue DLL Filename (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055.001 ·

Share on:

Detects Gamarue DLL filename in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Potential Homoglyph Attack Using Lookalike Characters

May 10, 2023 · attack.defense_evasion attack.t1036 attack.t1036.003 attack.t1036.008 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Powershell Base64 Encoding (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of powershell.exe with base64 Option. Part of the RedCanary 2023 Threat Detection Report.

Powershell Encoded Command Switch (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Part of the RedCanary 2023 Threat Detection Report.

Powershell Injecting Into Anything (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.

Powershell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects powershell command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Process Executing Sans Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects processes running without command lines, which can indicate process injection. Part of the RedCanary 2023 Threat Detection Report.

Process Execution from Admin Share (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects processes executing from an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Processes Executing with Unusual Command Lines (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects non-powershell.exe processes executing with command lines that are usually associated with powershell. This is an example for demonstration purposes only. Part of the RedCanary 2023 Threat Detection Report.

QBot Mounted Drive Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0650 ·

Share on:

Detects process creation from wscript or cscript interpreters with commands occuring on mounted drive letters. Defenders should check whether these processes have child processes. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Application Bypass with DllRegisterServer Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the DllRegisterServer export function implemented with Rundll32. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Dumping Credentials with MiniDump Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects processes that seem to be rundll32.exe along with a command line containing the term MiniDump. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Injection into LSASS (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances of Rundll32 being spawned by unusual or suspicious parent processes. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Without a Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances of Rundll32 without a command line spawning child processes. Part of the RedCanary 2023 Threat Detection Report.

Service Control Manager Spawning Command Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects suspect command line strings in CMD processes spawned by services.exe. Part of the RedCanary 2023 Threat Detection Report.

SocGholish NLTest Domain Trust Enumeration (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1482 ·

Share on:

Detects domain trust enumeration with nltest.exe, a procedure associated with SocGholish. Part of the RedCanary 2023 Threat Detection Report.

SocGholish Script File Whoami Output to File (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects wscript spawning CMD which in turn runs whoami, with the output of the command directed to a file. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Network Connections (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects notepad making network connections, a potential process injection signal. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Powershell Commandlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of powershell.exe with suspicious cmdlets or options. Part of the RedCanary 2023 Threat Detection Report.

Unexpected Internal Process Name (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects powershell processes renamed to notepad.exe. This is a narrow example for demonstration purposes only. Part of the RedCanary 2023 Threat Detection Report.

Windows Scheduled Task Create Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects attempts to establish persistence using schtasks and command shell. Part of the RedCanary 2023 Threat Detection Report.

Windows Scripting Host Executing JScript Files with MS-DOS Short Names (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Windows scripting host executing JavaScript files with MS-DOS shortname formatting, a technique associated with Gootloader. Part of the RedCanary 2023 Threat Detection Report.

WMI Reconnaissance (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the wmic reconnaissance activity. Part of the RedCanary 2023 Threat Detection Report.

WMI Shadow Copy Deletion (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects wmic shadow copy deletion activity. Part of the RedCanary 2023 Threat Detection Report.

WMI Suspicious Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the wmic process with suspicious options. Part of the RedCanary 2023 Threat Detection Report.

WMI Suspicious Powershell Cmdlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects WMI-related suspicious powershell cmdlets. Part of the RedCanary 2023 Threat Detection Report.

WMI Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the WMI provider host spawning suspicious processes. Part of the RedCanary 2023 Threat Detection Report.

WMIC Unusual Module Loads (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the wmic process module loads potentially to perform application control bypasses. Part of the RedCanary 2023 Threat Detection Report.

Yellow Cockatoo Powershell Startup Folder Persistence (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects .lnk files created by Powershell in the startup folder. Associated with (but not unique to) Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Yellow Cockatoo PowerShell Suspicious .NET Methods (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects suspicious Powershell script load contents associated with Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.