security

account_management

Nov 27, 2023 ·

Windows Defender Exclusion Deleted

Nov 15, 2023 · attack.defense_evasion attack.t1562.001 ·

Detects when a Windows Defender exclusion has been deleted. This could indicate an attacker trying to delete their tracks by removing the added exclusions

Windows Defender Exclusion List Modified

Nov 15, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.

Windows Defender Exclusion Reigstry Key - Write Access Requested

Nov 15, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

ISO Image Mounted

Nov 10, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the mount of an ISO image on an endpoint

Potential AD User Enumeration From Non-Machine Account

Nov 8, 2023 · attack.discovery attack.t1087.002 ·

Share on:

Detects read access to a domain user from a non-machine account

Service Installed By Unusual Client - Security

Nov 2, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Win Susp Computer Name Containing Samtheadmin

Nov 2, 2023 · cve.2021.42278 cve.2021.42287 attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Active Directory Replication from Non Machine Account

Oct 18, 2023 · attack.credential_access attack.t1003.006 ·

Share on:

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

AD Privileged Users or Groups Reconnaissance

Oct 18, 2023 · attack.discovery attack.t1087.002 ·

Share on:

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Invoke-Obfuscation CLIP+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation RUNDLL LAUNCHER - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation STDIN+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use MSHTA - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use Rundll32 - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Oct 18, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Possible Shadow Credentials Added

Oct 18, 2023 · attack.credential_access attack.t1556 ·

Share on:

Detects possible addition of shadow credentials to an active directory object.

SCM Database Handle Failure

Oct 18, 2023 · attack.discovery attack.t1010 ·

Share on:

Detects non-system users failing to get a handle of the SCM database.

Suspicious Outbound Kerberos Connection - Security

Oct 18, 2023 · attack.lateral_movement attack.t1558.003 ·

Share on:

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Oct 18, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1558.003 ·

Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Add or Remove Computer from DC

Oct 17, 2023 · attack.defense_evasion attack.t1207 ·

Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Device Installation Blocked

Oct 17, 2023 · attack.initial_access attack.t1200 ·

Share on:

Detects an installation of a device that is forbidden by the system policy

Invoke-Obfuscation Obfuscated IEX Invocation - Security

Oct 17, 2023 · attack.defense_evasion attack.t1027 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

LSASS Access from Non System Account

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects potential mimikatz-like tools accessing LSASS from non system account

Metasploit Or Impacket Service Installation Via SMB PsExec

Oct 17, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Mimikatz DC Sync

Oct 17, 2023 · attack.credential_access attack.s0002 attack.t1003.006 ·

Share on:

Detects Mimikatz DC sync security events

Password Protected ZIP File Opened

Oct 17, 2023 · attack.defense_evasion attack.t1027 ·

Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Password Protected ZIP File Opened (Email Attachment)

Oct 17, 2023 · attack.defense_evasion attack.initial_access attack.t1027 attack.t1566.001 ·

Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Password Protected ZIP File Opened (Suspicious Filenames)

Oct 17, 2023 · attack.command_and_control attack.defense_evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

PetitPotam Suspicious Kerberos TGT Request

Oct 17, 2023 · attack.credential_access attack.t1187 ·

Share on:

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

Possible DC Shadow Attack

Oct 17, 2023 · attack.credential_access attack.t1207 ·

Share on:

Detects DCShadow via create new SPN

Possible Impacket SecretDump Remote Activity

Oct 17, 2023 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·

Share on:

Detect AD credential dumping using impacket secretdump HKTL

Possible PetitPotam Coerce Authentication Attempt

Oct 17, 2023 · attack.credential_access attack.t1187 ·

Share on:

Detect PetitPotam coerced authentication activity.

Powerview Add-DomainObjectAcl DCSync AD Extend Right

Oct 17, 2023 · attack.persistence attack.t1098 ·

Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

RDP over Reverse SSH Tunnel WFP

Oct 17, 2023 · attack.defense_evasion attack.command_and_control attack.lateral_movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

Replay Attack Detected

Oct 17, 2023 · attack.credential_access attack.t1558 ·

Share on:

Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Suspicious Kerberos RC4 Ticket Encryption

Oct 17, 2023 · attack.credential_access attack.t1558.003 ·

Share on:

Detects service ticket requests using RC4 encryption type

Suspicious Remote Logon with Explicit Credentials

Oct 17, 2023 · attack.t1078 attack.lateral_movement ·

Share on:

Detects suspicious processes logging on with explicit credentials

Suspicious Scheduled Task Creation

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·

Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Suspicious Scheduled Task Update

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·

Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Suspicious Teams Application Related ObjectAcess Event

Oct 17, 2023 · attack.credential_access attack.t1528 ·

Share on:

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

User Logoff Event

Oct 17, 2023 ·

Share on:

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

User with Privileges Logon

Oct 17, 2023 · attack.defense_evasion attack.lateral_movement attack.credential_access attack.t1558 attack.t1649 attack.t1550 ·

Share on:

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

VSSAudit Security Event Source Registration

Oct 17, 2023 · attack.credential_access attack.t1003.002 ·

Share on:

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

Potentially Suspicious AccessMask Requested From LSASS

Oct 12, 2023 · attack.credential_access car.2019-04-004 attack.t1003.001 ·

Share on:

Detects process handle on LSASS process with certain access mask

Service Registry Key Read Access Request

Sep 29, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.011 ·

Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Credential Dumping Tools Service Execution - Security

Aug 7, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·

Share on:

Detects well-known credential dumping tools execution via service execution events

Important Windows Event Auditing Disabled

Jul 13, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Windows Event Auditing Disabled

Jul 13, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.

Enabled User Right in AD to Control User Objects

Jun 26, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

SMB Create Remote File Admin Share

Jun 26, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Weak Encryption Enabled and Kerberoast

Jun 26, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.

Remote Access Tool Services Have Been Installed - Security

Jun 21, 2023 · attack.persistence attack.t1543.003 attack.t1569.002 ·

Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

External Disk Drive Or USB Storage Device

Jun 21, 2023 · attack.t1091 attack.t1200 attack.lateral_movement attack.initial_access ·

Share on:

Detects external diskdrives or plugged in USB devices, EventID 6416 on Windows 10 or later

Local User Creation

Jun 21, 2023 · attack.persistence attack.t1136.001 ·

Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Password Policy Enumerated

May 18, 2023 · attack.discovery attack.t1201 ·

Share on:

Detects when the password policy is enumerated.

Hidden Local User Creation

May 2, 2023 · attack.persistence attack.t1136.001 ·

Share on:

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Windows Pcap Drivers

Apr 14, 2023 · attack.discovery attack.credential_access attack.t1040 ·

Share on:

Detects Windows Pcap driver installation based on a list of associated .sys files.

DPAPI Domain Master Key Backup Attempt

Mar 15, 2023 · attack.credential_access attack.t1003.004 ·

Share on:

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

First Time Seen Remote Named Pipe

Mar 14, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Important Scheduled Task Deleted/Disabled

Mar 14, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·

Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Potential Privileged System Service Operation - SeLoadDriverPrivilege

Feb 27, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

T1047 Wmiprvse Wbemcomn DLL Hijack

Feb 27, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

Transferring Files with Credential Data via Network Shares

Feb 27, 2023 · attack.credential_access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·

Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

User Added to Local Administrators

Feb 27, 2023 · attack.privilege_escalation attack.t1078 attack.persistence attack.t1098 ·

Share on:

This rule triggers on user accounts that are added to the local Administrators group, which could be legitimate activity or a sign of privilege escalation activity

AD Object WriteDAC Access

Feb 7, 2023 · attack.defense_evasion attack.t1222.001 ·

Share on:

Detects WRITE_DAC access to a domain object

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Feb 7, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

DPAPI Domain Backup Key Extraction

Feb 7, 2023 · attack.credential_access attack.t1003.004 ·

Share on:

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Protected Storage Service Access

Feb 7, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Remote PowerShell Sessions Network Connections (WinRM)

Feb 7, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

SAM Registry Hive Handle Request

Feb 7, 2023 · attack.discovery attack.t1012 attack.credential_access attack.t1552.002 ·

Share on:

Detects handles requested to SAM registry hive

SCM Database Privileged Operation

Feb 7, 2023 · attack.privilege_escalation attack.t1548 ·

Share on:

Detects non-system users performing privileged operation os the SCM database

SysKey Registry Keys Access

Feb 7, 2023 · attack.discovery attack.t1012 ·

Share on:

Detects handle requests and access operations to specific registry keys to calculate the SysKey

Access to ADMIN$ Share

Feb 1, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects access to $ADMIN share

CobaltStrike Service Installations - Security

Feb 1, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Hacktool Ruler

Feb 1, 2023 · attack.discovery attack.execution attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·

Share on:

This events that are generated when using the hacktool Ruler by Sensepost

Kerberos Manipulation

Feb 1, 2023 · attack.credential_access attack.t1212 ·

Share on:

This method triggers on rare Kerberos Failure Codes caused by manipulations of Kerberos messages

Malicious Service Installations

Feb 1, 2023 · attack.persistence attack.privilege_escalation attack.t1003 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

NetNTLM Downgrade Attack

Feb 1, 2023 · attack.defense_evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

Reconnaissance Activity

Feb 1, 2023 · attack.discovery attack.t1087.002 attack.t1069.002 attack.s0039 ·

Share on:

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Security Eventlog Cleared

Feb 1, 2023 · attack.defense_evasion attack.t1070.001 car.2016-04-002 ·

Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

WMI Persistence - Security

Feb 1, 2023 · attack.persistence attack.privilege_escalation attack.t1546.003 ·

Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Suspicious Access to Sensitive File Extensions

Dec 27, 2022 · attack.collection attack.t1039 ·

Share on:

Detects known sensitive file extensions accessed on a network share

ADCS Certificate Template Configuration Vulnerability

Dec 27, 2022 · attack.privilege_escalation attack.credential_access ·

Share on:

Detects certificate creation with template allowing risk permission subject

ADCS Certificate Template Configuration Vulnerability with Risky EKU

Dec 27, 2022 · attack.privilege_escalation attack.credential_access ·

Share on:

Detects certificate creation with template allowing risk permission subject and risky EKU

Security Event Log Cleared

Dec 27, 2022 · attack.t1070.001 ·

Share on:

Checks for event id 1102 which indicates the security event log was cleared.

Locked Workstation

Dec 23, 2022 ·

Share on:

Automatically lock workstation sessions after a standard period of inactivity. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019.

ETW Logging Disabled In .NET Processes - Registry

Dec 20, 2022 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Failed Code Integrity Checks

Dec 7, 2022 · attack.defense_evasion attack.t1027.001 ·

Share on:

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

PowerShell Scripts Installed as Services - Security

Nov 30, 2022 · attack.execution attack.t1569.002 ·

Share on:

Detects powershell script installed as a Service

Tap Driver Installation - Security

Nov 30, 2022 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

New or Renamed User Account with '$' in Attribute 'SamAccountName'

Nov 22, 2022 · attack.defense_evasion attack.t1036 ·

Share on:

Detects possible bypass EDR and SIEM via abnormal user account name.

DCERPC SMB Spoolss Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Denied Access To Remote Desktop

Oct 25, 2022 · attack.lateral_movement attack.t1021.001 ·

Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

HybridConnectionManager Service Installation

Oct 25, 2022 · attack.persistence attack.t1554 ·

Share on:

Rule to detect the Hybrid Connection Manager service installation.

Impacket PsExec Execution

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects execution of Impacket's psexec.py.

Persistence and Execution at Scale via GPO Scheduled Task

Oct 25, 2022 · attack.persistence attack.lateral_movement attack.t1053.005 ·

Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Processes Accessing the Microphone and Webcam

Oct 25, 2022 · attack.collection attack.t1123 ·

Share on:

Potential adversaries accessing the microphone and webcam in an endpoint.

Remote Service Activity via SVCCTL Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.persistence attack.t1021.002 ·

Share on:

Detects remote service activity via remote access to the svcctl named pipe

Remote Task Creation via ATSVC Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Secure Deletion with SDelete

Oct 25, 2022 · attack.impact attack.defense_evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·

Share on:

Detects renaming of file while deletion with SDelete tool.

Suspicious LDAP-Attributes Used

Oct 25, 2022 · attack.t1001.003 attack.command_and_control ·

Share on:

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

Suspicious PsExec Execution

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Sysmon Channel Reference Deletion

Oct 25, 2022 · attack.defense_evasion attack.t1112 ·

Share on:

Potential threat actor tampering with Sysmon manifest and eventually disabling it

Unauthorized System Time Modification

Oct 25, 2022 · attack.defense_evasion attack.t1070.006 ·

Share on:

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

WCE wceaux.dll Access

Oct 25, 2022 · attack.credential_access attack.t1003 attack.s0005 ·

Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Windows Network Access Suspicious desktop.ini Action

Oct 25, 2022 · attack.persistence attack.t1547.009 ·

Share on:

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Addition of Domain Trusts

Oct 14, 2022 · attack.persistence attack.t1098 ·

Share on:

Addition of domains is seldom and should be verified for legitimacy.

Addition of SID History to Active Directory Object

Oct 14, 2022 · attack.persistence attack.privilege_escalation attack.t1134.005 ·

Share on:

An attacker can use the SID history attribute to gain additional privileges.

Azure AD Health Monitoring Agent Registry Keys Access

Oct 14, 2022 · attack.discovery attack.t1012 ·

Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

Azure AD Health Service Agents Registry Keys Access

Oct 14, 2022 · attack.discovery attack.t1012 ·

Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

Metasploit SMB Authentication

Oct 14, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Alerts on Metasploit host's authentications on the domain.

Password Change on Directory Service Restore Mode (DSRM) Account

Oct 14, 2022 · attack.persistence attack.t1098 ·

Share on:

The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.

Password Dumper Activity on LSASS

Oct 14, 2022 · attack.credential_access attack.t1003.001 ·

Share on:

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

Register new Logon Process by Rubeus

Oct 14, 2022 · attack.lateral_movement attack.privilege_escalation attack.t1558.003 ·

Share on:

Detects potential use of Rubeus via registered new trusted logon process

Suspicious Windows ANONYMOUS LOGON Local Account Created

Oct 14, 2022 · attack.persistence attack.t1136.001 attack.t1136.002 ·

Share on:

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.