file_event

SCR File Write Event

Sep 18, 2023 · attack.defense_evasion attack.t1218.011 ·

Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

LSASS Process Memory Dump Files

Sep 13, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

ISO or Image Mount Indicator in Recent Files

Aug 28, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

Suspicious Interactive PowerShell as SYSTEM

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Windows Binaries Write Suspicious Extensions

Aug 28, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Windows executables that writes files with suspicious extensions

Windows Shell/Scripting Application File Write to Suspicious Folder

Aug 28, 2023 · attack.execution attack.t1059 ·

Share on:

Detects Windows shells and scripting applications that write files to suspicious folders

WScript or CScript Dropper - File

Aug 28, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe

Assembly DLL Creation Via AspNetCompiler

Aug 18, 2023 · attack.execution ·

Share on:

Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Aug 15, 2023 · attack.defense_evasion attack.t1216 ·

Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

RemCom Service File Creation

Aug 10, 2023 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects default RemCom service filename which indicates RemCom service installation and execution

Cred Dump Tools Dropped Files

Aug 7, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.003 attack.t1003.004 attack.t1003.005 ·

Share on:

Files with well-known filenames (parts of credential dump software or files produced by them) creation

CSExec Service File Creation

Aug 7, 2023 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects default CSExec service filename which indicates CSExec service installation and execution

PsExec Service File Creation

Aug 7, 2023 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects default PsExec service filename which indicates PsExec service installation and execution

New Shim Database Created in the Default Directory

Aug 1, 2023 · attack.persistence attack.t1547.009 ·

Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Suspicious File Creation Activity From Fake Recycle.Bin Folder

Jul 24, 2023 · attack.persistence attack.defense_evasion ·

Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Windows Terminal Profile Settings Modification By Uncommon Process

Jul 24, 2023 · attack.persistence attack.t1547.015 ·

Share on:

Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

EVTX Created In Uncommon Location

Jul 13, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects the creation of new files with the ".evtx" extension in non-common locations. Which could indicate tampering with default evtx locations in order to evade security controls

Typical HiveNightmare SAM File Export

Jul 13, 2023 · attack.credential_access attack.t1552.001 cve.2021.36934 ·

Share on:

Detects files written by the different tools that exploit HiveNightmare

File With Uncommon Extension Created By An Office Application

Jul 13, 2023 · attack.t1204.002 attack.execution ·

Share on:

Detects the creation of files with an executable or script extension by an Office application.

Legitimate Application Dropped Archive

Jul 13, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects programs on a Windows system that should not write an archive to disk

Legitimate Application Dropped Executable

Jul 13, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects programs on a Windows system that should not write executables to disk

Legitimate Application Dropped Script

Jul 13, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects programs on a Windows system that should not write scripts to disk

Potential Persistence Via Microsoft Office Startup Folder

Jul 13, 2023 · attack.persistence attack.t1137 ·

Share on:

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Uncommon File Created In Office Startup Folder

Jul 13, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects the creation of a file with an uncommon extension in an Office application startup folder

ISO File Created Within Temp Folders

Jun 22, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

Suspicious Double Extension Files

Jun 21, 2023 · attack.defense_evasion attack.t1036.007 ·

Share on:

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

PSScriptPolicyTest Creation By Uncommon Process

Jun 1, 2023 · attack.defense_evasion ·

Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

LiveKD Driver Creation

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the creation of the LiveKD driver, which is used for live kernel debugging

LiveKD Driver Creation By Uncommon Process

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

LiveKD Kernel Memory Dump File Created

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

HackTool - Dumpert Process Dumper Default File

May 15, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

Potential Binary Or Script Dropper Via PowerShell

May 15, 2023 · attack.persistence ·

Share on:

Detects PowerShell creating a binary executable or a script file.

Potential Persistence Attempt Via ErrorHandler.Cmd

May 15, 2023 · attack.persistence ·

Share on:

Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.

Potential Remote Credential Dumping Activity

May 15, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Potential Suspicious PowerShell Module File Created

May 15, 2023 · attack.persistence ·

Share on:

Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.

PowerShell Module File Created

May 15, 2023 · attack.persistence ·

Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.

PowerShell Module File Created By Non-PowerShell Process

May 15, 2023 · attack.persistence ·

Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

PowerShell Script Dropped Via PowerShell.EXE

May 15, 2023 · attack.persistence ·

Share on:

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

PSEXEC Remote Execution File Artefact

May 15, 2023 · attack.lateral_movement attack.privilege_escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·

Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Rclone Config File Creation

May 15, 2023 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects Rclone config files being created

ScreenConnect Temporary Installation Artefact

May 15, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Suspicious File Creation In Uncommon AppData Folder

May 15, 2023 · attack.defense_evasion attack.execution ·

Share on:

Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs

Suspicious LNK Double Extension File

May 15, 2023 · attack.defense_evasion attack.t1036.007 ·

Share on:

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

WinSxS Executable File Creation By Non-System Process

May 12, 2023 · attack.execution ·

Share on:

Detects the creation of binaries in the WinSxS folder by non-system processes

NTDS.DIT Creation By Uncommon Parent Process

May 9, 2023 · attack.credential_access attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

Potential Homoglyph Attack Using Lookalike Characters in Filename

May 8, 2023 · attack.defense_evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Process Explorer Driver Creation By Non-Sysinternals Binary

May 5, 2023 · attack.persistence attack.privilege_escalation attack.t1068 ·

Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Process Monitor Driver Creation By Non-Sysinternals Binary

May 5, 2023 · attack.persistence attack.privilege_escalation attack.t1068 ·

Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

NTDS Exfiltration Filename Patterns

May 5, 2023 · attack.credential_access attack.t1003.003 ·

Share on:

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

NTDS.DIT Created

May 5, 2023 · attack.credential_access attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database)

NTDS.DIT Creation By Uncommon Process

May 5, 2023 · attack.credential_access attack.t1003.002 attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Suspicious DotNET CLR Usage Log Artifact

May 5, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.

Suspicious File Created In PerfLogs

May 5, 2023 · attack.execution attack.t1059 ·

Share on:

Detects suspicious file based on their extension being created in "C:\PerfLogs". Note that this directory mostly contains ".etl" files

VHD Image Download Via Browser

May 5, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.

Malicious PowerShell Scripts - FileCreation

Apr 21, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of known offensive powershell scripts used for exploitation

RDP File Creation From Suspicious Application

Apr 19, 2023 · attack.defense_evasion ·

Share on:

Detects Rclone config file being created

Office Macro File Download

Apr 18, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a new office macro files on the systems via an application (browser, mail client).

BloodHound Collection Files

Apr 11, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Files With System Process Name In Unsuspected Locations

Mar 23, 2023 · attack.defense_evasion attack.t1036.005 ·

Share on:

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64...etc).

Wmiexec Default Output File

Mar 9, 2023 · attack.lateral_movement attack.t1047 ·

Share on:

Detects the creation of the default output filename used by the wmiexec tool

Suspicious File Created Via OneNote Application

Mar 1, 2023 · attack.defense_evasion ·

Share on:

Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild

Office Macro File Creation

Feb 24, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a new office macro files on the systems

Office Macro File Creation From Suspicious Process

Feb 24, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a office macro file from a a suspicious process

File Creation In Suspicious Directory By Msdt.EXE

Feb 23, 2023 · attack.persistence attack.t1547.001 cve.2022.30190 ·

Share on:

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Potential Persistence Via Microsoft Office Add-In

Feb 23, 2023 · attack.persistence attack.t1137.006 ·

Share on:

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

Potential Persistence Via Notepad++ Plugins

Feb 23, 2023 · attack.persistence ·

Share on:

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Potential Persistence Via Outlook Form

Feb 23, 2023 · attack.persistence attack.t1137.003 ·

Share on:

Detects the creation of a new Outlook form which can contain malicious code

Potential Startup Shortcut Persistence Via PowerShell.EXE

Feb 23, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Suspicious Binary Writes Via AnyDesk

Feb 20, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Dynamic CSharp Compile Artefact

Feb 17, 2023 · attack.defense_evasion attack.t1027.004 ·

Share on:

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Inveigh Execution Artefacts

Feb 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects the presence and execution of Inveigh via dropped artefacts

Mimikatz Kirbi File Creation

Feb 17, 2023 · attack.credential_access attack.t1558 ·

Share on:

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Powerup Write Hijack DLL

Feb 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

QuarksPwDump Dump File

Feb 17, 2023 · attack.credential_access attack.t1003.002 ·

Share on:

Detects a dump file written by QuarksPwDump password dumper

SafetyKatz Default Dump Filename

Feb 17, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects default lsass dump filename from SafetyKatz

Creation Of Non-Existent System DLL

Feb 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects the creation of system dlls that are not present on the system. Usually to achieve dll hijacking

OneNote Attachment File Dropped In Suspicious Location

Feb 9, 2023 · attack.defense_evasion ·

Share on:

Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments

GatherNetworkInfo.VBS Reconnaissance Script Output

Feb 9, 2023 · attack.discovery ·

Share on:

Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".

New Outlook Macro Created

Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

Publisher Attachment File Dropped In Suspicious Location

Feb 8, 2023 · attack.defense_evasion ·

Share on:

Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attackers abusing Publisher documents

Suspicious Outlook Macro Created

Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

Startup Folder File Write

Feb 7, 2023 · attack.persistence attack.t1547.001 ·

Share on:

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Suspicious PFX File Creation

Feb 7, 2023 · attack.credential_access attack.t1552.004 ·

Share on:

A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.

Wmiprvse Wbemcomn DLL Hijack - File

Feb 7, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Adwind RAT / JRAT File Artifact

Feb 1, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

CrackMapExec File Creation Patterns

Feb 1, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects suspicious file creation patterns found in logs when CrackMapExec is used

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Feb 1, 2023 · attack.execution attack.privilege_escalation attack.resource_development attack.t1587 cve.2021.1675 ·

Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

CVE-2021-44077 POC Default Dropped File

Feb 1, 2023 · attack.execution cve.2021.44077 ·

Share on:

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

CVE-2022-24527 Microsoft Connected Cache LPE

Feb 1, 2023 · attack.privilege_escalation attack.t1059.001 cve.2022.24527 ·

Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Drop Binaries Into Spool Drivers Color Folder

Feb 1, 2023 · attack.defense_evasion ·

Share on:

Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color" as seen in the blog referenced below

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Feb 1, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

NPPSpy Hacktool Usage

Feb 1, 2023 · attack.credential_access ·

Share on:

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

Potential Privilege Escalation Attempt Via .Exe.Local Technique

Feb 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation ·

Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Potential SAM Database Dump

Feb 1, 2023 · attack.credential_access attack.t1003.002 ·

Share on:

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Suspicious ASPX File Drop by Exchange

Feb 1, 2023 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Suspicious Desktopimgdownldr Target File

Feb 1, 2023 · attack.defense_evasion attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Suspicious File Drop by Exchange

Feb 1, 2023 · attack.persistence attack.t1190 attack.initial_access attack.t1505.003 ·

Share on:

Detects suspicious file type dropped by an Exchange component in IIS

Suspicious MSExchangeMailboxReplication ASPX Write

Feb 1, 2023 · attack.initial_access attack.t1190 attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Suspicious Scheduled Task Write to System32 Tasks

Feb 1, 2023 · attack.persistence attack.execution attack.t1053 ·

Share on:

Detects the creation of tasks from processes executed from suspicious locations

Suspicious Startup Folder Persistence

Feb 1, 2023 · attack.persistence attack.t1547.001 ·

Share on:

Detects when a file with a suspicious extension is created in the startup folder

TeamViewer Remote Session

Feb 1, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects the creation of log files during a TeamViewer remote session

UAC Bypass Abusing Winsat Path Parsing - File

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Using .NET Code Profiler on MMC

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

UAC Bypass Using Consent and Comctl32 - File

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

UAC Bypass Using EventVwr

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the pattern of a UAC bypass using Windows Event Viewer

UAC Bypass Using IDiagnostic Profile - File

Feb 1, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IEInstal - File

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

UAC Bypass Using MSConfig Token Modification - File

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

UAC Bypass Using NTFS Reparse Point - File

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

UAC Bypass Using Windows Media Player - File

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UEFI Persistence Via Wpbbin - FileCreation

Feb 1, 2023 · attack.persistence attack.defense_evasion attack.t1542.001 ·

Share on:

Detects creation of a file named "wpbbin" in the "%systemroot%\system32" directory. Which could be indicative of UEFI based persistence method

VsCode Powershell Profile Modification

Feb 1, 2023 · attack.persistence attack.privilege_escalation attack.t1546.013 ·

Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

WerFault LSASS Process Memory Dump

Feb 1, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials

Anydesk Temporary Artefact

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Creation Exe for Service with Unquoted Path

Jan 27, 2023 · attack.persistence attack.t1547.009 ·

Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

GoToAssist Temporary Installation Artefact

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Installation of TeamViewer Desktop

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

TeamViewer_Desktop.exe is create during install

Suspicious Creation TXT File in User Desktop

Jan 27, 2023 · attack.impact attack.t1486 ·

Share on:

Ransomware create txt file in the user Desktop

Creation of an Executable by an Executable

Jan 26, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects the creation of an executable by another executable

Suspicious ADSI-Cache Usage By Unknown Tool

Jan 17, 2023 · attack.t1001.003 attack.command_and_control ·

Share on:

Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger.

Potential RipZip Attack on Startup Folder

Jan 6, 2023 · attack.persistence attack.t1547 ·

Share on:

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Potential Winnti Dropper Activity

Jan 6, 2023 · attack.defense_evasion attack.t1027 ·

Share on:

Detects files dropped by Winnti as described in RedMimicry Winnti playbook

Suspicious Creation with Colorcpl

Jan 6, 2023 · attack.defense_evasion attack.t1564 ·

Share on:

Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\

Suspicious Unattend.xml File Access

Dec 27, 2022 · attack.credential_access attack.t1552.001 ·

Share on:

Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored. If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process

PowerShell Profile Modification

Dec 19, 2022 · attack.persistence attack.privilege_escalation attack.t1546.013 ·

Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Potential DCOM InternetExplorer.Application DLL Hijack

Dec 18, 2022 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

LSASS Process Dump Artefact In CrashDumps Folder

Dec 16, 2022 · attack.credential_access attack.t1003.001 ·

Share on:

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

Advanced IP Scanner - File Event

Nov 30, 2022 · attack.discovery attack.t1046 ·

Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Suspicious PROCEXP152.sys File Created In TMP

Nov 22, 2022 · attack.t1562.001 attack.defense_evasion ·

Share on:

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.

Suspicious Screensaver Binary File Creation

Nov 8, 2022 · attack.persistence attack.t1546.002 ·

Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Potential Initial Access via DLL Search Order Hijacking

Oct 28, 2022 · attack.t1566 attack.t1566.001 attack.initial_access attack.t1574 attack.t1574.001 attack.defense_evasion ·

Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Created Files by Microsoft Sync Center

Oct 26, 2022 · attack.t1055 attack.t1218 attack.execution attack.defense_evasion ·

Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Creation of a Diagcab

Oct 26, 2022 · attack.resource_development ·

Share on:

Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)

Creation of an WerFault.exe in Unusual Folder

Oct 26, 2022 · attack.persistence attack.defense_evasion attack.t1574.001 ·

Share on:

Detects WerFault copoed to a suspicious folder, which could be a sign of WerFault DLL hijacking

CVE-2021-26858 Exchange Exploitation

Oct 26, 2022 · attack.t1203 attack.execution cve.2021.26858 ·

Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

DLL Search Order Hijackig Via Additional Space in Path

Oct 26, 2022 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.002 ·

Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Hijack Legit RDP Session to Move Laterally

Oct 26, 2022 · attack.command_and_control attack.t1219 ·

Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Malicious DLL File Dropped in the Teams or OneDrive Folder

Oct 26, 2022 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.002 ·

Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file (“iphlpapi.dll”) is sideloaded

Octopus Scanner Malware

Oct 26, 2022 · attack.t1195 attack.t1195.001 ·

Share on:

Detects Octopus Scanner Malware.

Suspicious desktop.ini Action

Oct 26, 2022 · attack.persistence attack.t1547.009 ·

Share on:

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Suspicious Executable File Creation

Oct 26, 2022 · attack.defense_evasion attack.t1564 ·

Share on:

Detect creation of suspicious executable file name. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.

Suspicious File Event With Teams Objects

Oct 26, 2022 · attack.credential_access attack.t1528 ·

Share on:

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Suspicious Files in Default GPO Folder

Oct 26, 2022 · attack.t1036.005 attack.defense_evasion ·

Share on:

Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder

Suspicious Get-Variable.exe Creation

Oct 26, 2022 · attack.persistence attack.t1546 attack.defense_evasion attack.t1027 ·

Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.