process_creation | Detection.FYI

Suspicious Windows Service Tampering

Dec 27, 2024 · attack.defense-evasion attack.t1489 attack.t1562.001 ·
Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Read More
QuickAssist Execution

Dec 19, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Read More
Webshell Detection With Command Line Keywords

Dec 14, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More
Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Always Install Elevated Windows Installer

Dec 1, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Read More
Permission Check Via Accesschk.EXE

Dec 1, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
Potential Privilege Escalation via Service Permissions Weakness

Dec 1, 2024 · attack.privilege-escalation attack.t1574.011 ·
Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Read More
Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·
Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Read More
Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Suspicious Child Process Created as System

Dec 1, 2024 · attack.privilege-escalation attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Read More
Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Read More
Suspicious Process By Web Server Process

Dec 1, 2024 · attack.persistence attack.t1505.003 attack.t1190 ·
Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More
Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·
Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Read More
Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Read More
UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read More
UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Read More
UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

Read More
UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Read More
Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·
Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Read More
Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Read More
Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Read More
CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

Read More
HackTool - SharpMove Tool Execution

Dec 1, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

Read More
HackTool - SOAPHound Execution

Dec 1, 2024 · attack.discovery attack.t1087 ·
Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Read More
Malicious PowerShell Commandlets - ProcessCreation

Dec 1, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Potential Dropper Script Execution Via WScript/CScript

Dec 1, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects wscript/cscript executions of scripts located in user directories

Read More
PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·
Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

Read More
PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·
Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

Read More
Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Read More
Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Read More
Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
System Disk And Volume Reconnaissance Via Wmic.EXE

Dec 1, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·
Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Read More
HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
HackTool - CreateMiniDump Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

Read More
HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects the execution GMER tool based on image and hash fields.

Read More
HackTool - HandleKatz LSASS Dumper Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

Read More
HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·
Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Read More
HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·
Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More
HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·
Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Read More
HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·
Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Read More
HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·
Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Read More
HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Read More
HackTool - Windows Credential Editor (WCE) Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE)

Read More
Hacktool Execution - Imphash

Nov 25, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More
MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Read More
Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

Read More
PUA - Nimgrab Execution

Nov 25, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

Read More
PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

Read More
PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More
PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Read More
Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Read More
Renamed AdFind Execution

Nov 25, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·
Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Read More
Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Read More
Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Read More
Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Read More
Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Read More
Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Read More
Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Read More
Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Read More
Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Read More
Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Read More
Compressed File Creation Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·
Share on:

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Read More
Compressed File Extraction Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·
Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Read More
Cscript/Wscript Potentially Suspicious Child Process

Nov 1, 2024 · attack.execution ·
Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Read More
Firewall Configuration Discovery Via Netsh.EXE

Nov 1, 2024 · attack.discovery attack.t1016 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

Read More
HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

Read More
Potentially Suspicious Command Targeting Teams Sensitive Files

Nov 1, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Read More
Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of a renamed "cloudflared" binary.

Read More
Suspicious Greedy Compression Using Rar.EXE

Nov 1, 2024 · attack.execution attack.t1059 ·
Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Read More
Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Read More
Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Read More
Uncommon System Information Discovery Via Wmic.EXE

Nov 1, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

Read More
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Read More
Suspicious File Download From File Sharing Domain Via Curl.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Read More
Suspicious File Download From File Sharing Domain Via Wget.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Read More
HackTool - Certipy Execution

Oct 8, 2024 · attack.discovery attack.credential-access attack.t1649 ·
Share on:

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Read More
Potentially Suspicious JWT Token Search Via CLI

Oct 6, 2024 · attack.credential-access attack.t1528 ·
Share on:

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Read More
Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new potentially suspicious download sources

Read More
Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Read More
Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·
Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Oct 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·
Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Permission Misconfiguration Reconnaissance Via Findstr.EXE

Oct 1, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Read More
Portable Gpg.EXE Execution

Oct 1, 2024 · attack.impact attack.t1486 ·
Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Read More
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Oct 1, 2024 · attack.t1021.003 attack.lateral-movement ·
Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Read More
Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Read More
Potentially Suspicious Electron Application CommandLine

Oct 1, 2024 · attack.execution ·
Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Read More
PowerShell Execution With Potential Decryption Capabilities

Oct 1, 2024 · attack.execution ·
Share on:

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Read More
Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Read More
Security Tools Keyword Lookup Via Findstr.EXE

Oct 1, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Read More
Suspicious Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·
Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Read More
Unusual Parent Process For Cmd.EXE

Oct 1, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious parent process for cmd.exe

Read More
Whoami.EXE Execution Anomaly

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Read More
Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Read More
Whoami.EXE Execution With Output Option

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Read More
Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Read More
HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Read More
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Read More
Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·
Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Read More
Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
PowerShell Web Access Feature Enabled Via DISM

Sep 3, 2024 · attack.persistence attack.t1548.002 ·
Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Read More
File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·
Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Read More
File Download From IP URL Via Curl.EXE

Sep 2, 2024 · attack.execution ·
Share on:

Detects file downloads directly from IP address URL using curl.exe

Read More
Obfuscated IP Via CLI

Sep 2, 2024 · attack.discovery ·
Share on:

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

Read More
Obfuscated PowerShell OneLiner Execution

Sep 2, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Read More
Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Read More
Potentially Suspicious Office Document Executed From Trusted Location

Sep 2, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Read More
Python Function Execution Security Warning Disabled In Excel

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More
Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Read More
Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

Read More
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Aug 29, 2024 · attack.discovery attack.t1135 ·
Share on:

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

Read More
HackTool - SharpWSUS/WSUSpendu Execution

Aug 29, 2024 · attack.execution attack.lateral-movement attack.t1210 ·
Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Read More
Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Aug 29, 2024 · attack.t1564.002 ·
Share on:

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
Potential AMSI Bypass Via .NET Reflection

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Read More
RestrictedAdminMode Registry Value Tampering - ProcCreation

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·
Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Read More
Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Aug 29, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Read More
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

Aug 29, 2024 · attack.execution ·
Share on:

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

Read More
COM Object Execution via Xwizard.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

Read More
New Capture Session Launched Via DXCap.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Read More
Potential DLL Injection Via AccCheckConsole

Aug 29, 2024 · attack.execution detection.threat-hunting ·
Share on:

Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

Read More
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Aug 29, 2024 · attack.credential-access attack.discovery attack.t1552 ·
Share on:

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Read More
Process Memory Dump via RdrLeakDiag.EXE

Aug 29, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Read More
Program Executed Using Proxy/Local Command Via SSH.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Read More
Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Read More
Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Read More
Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Read More
Wusa.EXE Executed By Parent Process Located In Suspicious Location

Aug 29, 2024 · attack.execution ·
Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Read More
Xwizard.EXE Execution From Non-Default Location

Aug 29, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Read More
Disable Important Scheduled Task

Aug 26, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 23, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Read More
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 23, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Read More
Data Export From MSSQL Table Via BCP.EXE

Aug 20, 2024 · attack.execution attack.t1048 ·
Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Read More
Potentially Suspicious Rundll32.EXE Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·
Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Read More
Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 16, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Read More
HackTool - LaZagne Execution

Aug 16, 2024 · attack.credential-access ·
Share on:

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

Read More
7Zip Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Aug 12, 2024 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
Abusing Print Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Attackers can use print.exe for remote file copy

Read More
Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database.

Read More
Active Directory Structure Export Via Csvde.EXE

Aug 12, 2024 · attack.exfiltration attack.discovery attack.t1087.002 ·
Share on:

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Read More
Active Directory Structure Export Via Ldifde.EXE

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

Read More
Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Read More
Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new additional download sources

Read More
Add SafeBoot Keys Via Reg Utility

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Read More
Add Windows Capability Via PowerShell Cmdlet

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
AddinUtil.EXE Execution From Uncommon Directory

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Read More
AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
All Backups Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Read More
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Read More
Always Install Elevated MSI Spawned Cmd And Powershell

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read More
Application Removed Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the removal or uninstallation of an application via "Wmic.EXE".

Read More
Application Terminated Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects calls to the "terminate" function via wmic in order to kill an application

Read More
Arbitrary Binary Execution Using GUP Utility

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

Read More
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Read More
Arbitrary File Download Via ConfigSecurityPolicy.EXE

Aug 12, 2024 · attack.exfiltration attack.t1567 ·
Share on:

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Read More
Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Read More
Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Read More
Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Read More
Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Read More
Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Read More
Arbitrary Shell Command Execution Via Settingcontent-Ms

Aug 12, 2024 · attack.t1204 attack.t1566.001 attack.execution attack.initial-access ·
Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Read More
AspNetCompiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Read More
Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Read More
Audio Capture via PowerShell

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Detects audio capture via PowerShell Cmdlet.

Read More
Audio Capture via SoundRecorder

Aug 12, 2024 · attack.collection attack.t1123 ·
Share on:

Detect attacker collecting audio via SoundRecorder application.

Read More
Audit Policy Tampering Via Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Audit Policy Tampering Via NT Resource Kit Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Automated Collection Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 attack.credential-access attack.t1552.001 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
Base64 Encoded PowerShell Command Detected

Aug 12, 2024 · attack.t1027 attack.defense-evasion attack.t1140 attack.t1059.001 ·
Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Read More
Base64 MZ Header In CommandLine

Aug 12, 2024 · attack.execution ·
Share on:

Detects encoded base64 MZ header in the commandline

Read More
BitLockerTogo.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

Read More
Boot Configuration Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Read More
Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of Chromium based browser in headless mode

Read More
Browser Started with Remote Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·
Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Read More
Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·
Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read More
Bypass UAC via Fodhelper.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Read More
Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Read More
C# IL Code Compilation Via Ilasm.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Read More
Capture Credentials with Rpcping.exe

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Read More
Certificate Exported Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Read More
Certificate Exported Via PowerShell

Aug 12, 2024 · attack.credential-access attack.execution attack.t1552.004 attack.t1059.001 ·
Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More
Change Default File Association To Executable Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·
Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change Default File Association Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·
Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change PowerShell Policies to an Insecure Level

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Read More
Changing Existing Service ImagePath Value Via Reg.EXE

Aug 12, 2024 · attack.persistence attack.t1574.011 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Chopper Webshell Process Pattern

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More
Chromium Browser Headless Execution To Mockbin Like Site

Aug 12, 2024 · attack.execution ·
Share on:

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Read More
Cmd.EXE Missing Space Characters Execution Anomaly

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

Read More
CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CobaltStrike Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Read More
Code Execution via Pcwutl.dll

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Read More
Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·
Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Read More
Compress Data and Lock With Password for Exfiltration With 7-ZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Read More
Compress Data and Lock With Password for Exfiltration With WINZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Read More
Computer Discovery And Export Via Get-ADComputer Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Read More
Computer Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects password change for the computer's domain account or host principal via "ksetup.exe"

Read More
Computer System Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1047 ·
Share on:

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

Read More
Conhost Spawned By Uncommon Parent Process

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Read More
Conhost.exe CommandLine Path Traversal

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Read More
Console CodePage Lookup Via CHCP

Aug 12, 2024 · attack.discovery attack.t1614.001 ·
Share on:

Detects use of chcp to look up the system locale value as part of host discovery

Read More
Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Read More
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

Aug 12, 2024 · attack.credential-access ·
Share on:

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Read More
Copy From Or To Admin Share Or Sysvol Folder

Aug 12, 2024 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·
Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

Read More
Copy From VolumeShadowCopy Via Cmd.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

Read More
Copying Sensitive Files with Credential Data

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·
Share on:

Files with well-known filenames (sensitive files with credential data) copying

Read More
CreateDump Process Dump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Read More
Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
Cscript/Wscript Uncommon Script Extension Execution

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Read More
Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Read More
Curl Web Request With Potential Custom User-Agent

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Read More
Data Copied To Clipboard Via Clip.EXE

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Read More
Delete All Scheduled Tasks

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Read More
Delete Important Scheduled Task

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More
Deleted Data Overwritten Via Cipher.EXE

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Read More
Deletion of Volume Shadow Copies via WMI with PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Read More
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Read More
Detect Virtualbox Driver Installation OR Starting Of VMs

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 attack.t1564 ·
Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Read More
Detected Windows Software Discovery

Aug 12, 2024 · attack.discovery attack.t1518 ·
Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Read More
Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
DeviceCredentialDeployment Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view

Read More
Devtoolslauncher.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

The Devtoolslauncher.exe executes other binary

Read More
Direct Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Read More
Directory Removal Via Rmdir

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
DirLister Execution

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Read More
Disable Windows Defender AV Security Monitoring

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Read More
Disable Windows IIS HTTP Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Read More
Disabled IE Security Features

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Read More
Disabled Volume Snapshots

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects commands that temporarily turn off Volume Snapshots

Read More
Discovery of a System Time

Aug 12, 2024 · attack.discovery attack.t1124 ·
Share on:

Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

Read More
Diskshadow Script Mode - Uncommon Script Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Read More
DLL Execution via Rasautou.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

Read More
DLL Execution Via Register-cimprovider.exe

Aug 12, 2024 · attack.defense-evasion attack.t1574 ·
Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read More
DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

Read More
DLL Sideloading by VMware Xfer Utility

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Read More
DllUnregisterServer Function Call Via Msiexec.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Read More
DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·
Share on:

Well-known DNS Exfiltration tools execution

Read More
Domain Trust Discovery Via Dsquery

Aug 12, 2024 · attack.discovery attack.t1482 ·
Share on:

Detects execution of "dsquery.exe" for domain trust discovery

Read More
Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

Read More
DriverQuery.EXE Execution

Aug 12, 2024 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Read More
Dropping Of Password Filter DLL

Aug 12, 2024 · attack.credential-access attack.t1556.002 ·
Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Read More
DSInternals Suspicious PowerShell Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
Dumping of Sensitive Hives Via Reg.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·
Share on:

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Read More
Dumping Process via Sqldumper.exe

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects process dump via legitimate sqldumper.exe binary

Read More
DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Read More
DumpStack.log Defender Evasion

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the use of the filename DumpStack.log to evade Microsoft Defender

Read More
Dynamic .NET Compilation Via Csc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Read More
Email Exifiltration Via Powershell

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects email exfiltration via powershell cmdlets

Read More
Enable LM Hash Storage - ProcCreation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Enumerate All Information With Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of "whoami.exe" with the "/all" flag

Read More
Enumeration for 3rd Party Creds From CLI

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·
Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Read More
Enumeration for Credentials in Registry

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·
Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Read More
Esentutl Gather Credentials

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.003 ·
Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Read More
Esentutl Steals Browser Information

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Read More
ETW Logging Tamper In .NET Processes Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Trace Evasion Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

Read More
Exchange PowerShell Snap-Ins Usage

Aug 12, 2024 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·
Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Read More
Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute Files with Msdeploy.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects file execution using the msdeploy.exe lolbin

Read More
Execute From Alternate Data Streams

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Read More
Execute MSDT Via Answer File

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Read More
Execute Pcwrun.EXE To Leverage Follina

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Read More
Execution Of Non-Existing File

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Read More
Execution of Powershell Script in Public Folder

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Read More
Execution via stordiag.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

Read More
Execution via WorkFolders.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects using WorkFolders.exe to execute an arbitrary control.exe

Read More
Explorer NOUACCHECK Flag

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·
Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Read More
Explorer Process Tree Break

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Read More
Exports Critical Registry Keys To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·
Share on:

Detects the export of a crital Registry key to a file.

Read More
Exports Registry Key To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·
Share on:

Detects the export of the target Registry key to a file.

Read More
File And SubFolder Enumeration Via Dir Command

Aug 12, 2024 · attack.discovery attack.t1217 ·
Share on:

Detects usage of the "dir" command part of Widows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

Read More
File Decoded From Base64/Hex Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

Read More
File Decryption Using Gpg4win

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to decrypt files

Read More
File Deletion Via Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the IEExec utility to download and execute files

Read More
File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

Read More
File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

Read More
File Download Using ProtocolHandler.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

Read More
File Download Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file

Read More
File Download Via Bitsadmin To A Suspicious Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

Read More
File Download Via Bitsadmin To An Uncommon Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

Read More
File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects when a user downloads a file by using CertOC.exe

Read More
File Download Via InstallUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE"

Read More
File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

Read More
File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Read More
File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

Read More
File Encryption Using Gpg4win

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt files

Read More
File Encryption/Decryption Via Gpg4win From Suspicious Locations

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Read More
File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

Read More
File Recovery From Backup Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

Read More
File With Suspicious Extension Downloaded Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

Read More
Files Added To An Archive Using Rar.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Filter Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detect filter driver unloading activity via fltmc.exe

Read More
Findstr GPP Passwords

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Read More
Findstr Launching .lnk File

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1202 attack.t1027.003 ·
Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Read More
Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Read More
Firewall Disabled via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0108 ·
Share on:

Detects netsh commands that turns off the Windows firewall

Read More
Firewall Rule Deleted Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Read More
Firewall Rule Update Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

Read More
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Aug 12, 2024 · attack.collection attack.t1074.001 ·
Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Forfiles Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

Read More
Fsutil Behavior Set SymlinkEvaluation

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Read More
Fsutil Drive Enumeration

Aug 12, 2024 · attack.discovery attack.t1120 ·
Share on:

Attackers may leverage fsutil to enumerated connected drives.

Read More
Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·
Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Read More
Gpresult Display Group Policy Information

Aug 12, 2024 · attack.discovery attack.t1615 ·
Share on:

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Read More
Gpscript Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Read More
Greedy File Deletion Using Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Read More
Group Membership Reconnaissance Via Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Read More
Gzip Archive Decode Via PowerShell

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

Read More
HackTool - ADCSPwn Execution

Aug 12, 2024 · attack.credential-access attack.t1557.001 ·
Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Read More
HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

Read More
HackTool - Certify Execution

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1649 ·
Share on:

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Read More
HackTool - Covenant PowerShell Launcher

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1564.003 ·
Share on:

Detects suspicious command lines used in Covenant luanchers

Read More
HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·
Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Read More
HackTool - CrackMapExec Process Patterns

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects suspicious process patterns found in logs when CrackMapExec is used

Read More
HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Read More
HackTool - Dumpert Process Dumper Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Read More
HackTool - Empire PowerShell Launch Parameters

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell command line parameters used in Empire

Read More
HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects some Empire PowerShell UAC bypass methods

Read More
HackTool - F-Secure C3 Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

Read More
HackTool - Hashcat Password Cracker Execution

Aug 12, 2024 · attack.credential-access attack.t1110.002 ·
Share on:

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

Read More
HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·
Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Read More
HackTool - Hydra Password Bruteforce Execution

Aug 12, 2024 · attack.credential-access attack.t1110 attack.t1110.001 ·
Share on:

Detects command line parameters used by Hydra password guessing hack tool

Read More
HackTool - Impacket Tools Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·
Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Read More
HackTool - Inveigh Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Read More
HackTool - Jlaive In-Memory Assembly Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

Read More
HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·
Share on:

Detects command line parameters used by Koadic hack tool

Read More
HackTool - KrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects the use of KrbRelay, a Kerberos relaying tool

Read More
HackTool - KrbRelayUp Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More
HackTool - Mimikatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection well-known mimikatz command line arguments

Read More
HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Read More
HackTool - PowerTool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

Read More
HackTool - PurpleSharp Execution

Aug 12, 2024 · attack.t1587 attack.resource-development ·
Share on:

Detects the execution of the PurpleSharp adversary simulation tool

Read More
HackTool - Pypykatz Credentials Dumping Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

Read More
HackTool - Quarks PwDump Execution

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects usage of the Quarks PwDump tool via commandline arguments

Read More
HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·
Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Read More
HackTool - RemoteKrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

Read More
HackTool - Rubeus Execution

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More
HackTool - SafetyKatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Read More
HackTool - SecurityXploded Execution

Aug 12, 2024 · attack.credential-access attack.t1555 ·
Share on:

Detects the execution of SecurityXploded Tools

Read More
HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Sharp Chisel via the commandline arguments

Read More
HackTool - SharpDPAPI Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

Read More
HackTool - SharPersist Execution

Aug 12, 2024 · attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
HackTool - SharpEvtMute Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - SharpLDAPmonitor Execution

Aug 12, 2024 · attack.discovery ·
Share on:

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

Read More
HackTool - SharpLdapWhoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

Read More
HackTool - SharpUp PrivEsc Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
HackTool - SILENTTRINITY Stager Execution

Aug 12, 2024 · attack.command-and-control attack.t1071 ·
Share on:

Detects SILENTTRINITY stager use via PE metadata

Read More
HackTool - Sliver C2 Implant Activity Pattern

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects process activity patterns as seen being used by Sliver C2 framework implants

Read More
HackTool - TruffleSnout Execution

Aug 12, 2024 · attack.discovery attack.t1482 ·
Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Read More
HackTool - winPEAS Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
HackTool - WinRM Access Via Evil-WinRM

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·
Share on:

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
HackTool - Wmiexec Default Powershell Command

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement ·
Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Read More
HackTool - XORDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious use of XORDump process memory dumping utility

Read More
Hacktool Execution - PE Metadata

Aug 12, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More
Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Read More
Harvesting Of Wifi Credentials Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detect the harvesting of wifi credentials using netsh.exe

Read More
HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the execution of "hh.exe" to open ".chm" files.

Read More
Hidden Powershell in Link File Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects events that appear when a user click on a link file with a powershell command in it

Read More
Hiding Files with Attrib.exe

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects usage of attrib.exe to hide files from users.

Read More
HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read More
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Read More
Ie4uinit Lolbin Use From Invalid Path

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

Read More
IIS Native-Code Module Command Line Installation

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious IIS native-code module installations via command line

Read More
ImagingDevices Unusual Parent/Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Read More
Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·
Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Read More
Import PowerShell Modules From Suspicious Directories - ProcCreation

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Imports Registry Key From a File

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of the specified file to the registry with regedit.exe.

Read More
Imports Registry Key From an ADS

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Read More
Indirect Command Execution By Program Compatibility Wizard

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Read More
Indirect Command Execution From Script File Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Read More
Indirect Inline Command Execution Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Read More
InfDefaultInstall.exe .inf Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Read More
Insecure Proxy/DOH Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

Read More
Insecure Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "--insecure" flag.

Read More
Insensitive Subfolder Search Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Read More
Install New Package Via Winget Local Manifest

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Read More
Interactive AT Job

Aug 12, 2024 · attack.privilege-escalation attack.t1053.002 ·
Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Read More
Interesting Service Enumeration Via Sc.EXE

Aug 12, 2024 · attack.t1003 ·
Share on:

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

Read More
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Read More
Invoke-Obfuscation CLIP+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation Obfuscated IEX Invocation

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Read More
Invoke-Obfuscation STDIN+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Java Running with Remote Debugging

Aug 12, 2024 · attack.t1203 attack.execution ·
Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Read More
JScript Compiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

Read More
Kavremover Dropped Binary LOLBIN Usage

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

Read More
Kernel Memory Dump Via LiveKD

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Read More
Launch-VsDevShell.PS1 Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·
Share on:

Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

Read More
Loaded Module Enumeration Via Tasklist.EXE

Aug 12, 2024 · attack.t1003 ·
Share on:

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Read More
Local Accounts Discovery

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1087.001 ·
Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Read More
Local File Read Using Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

Read More
Local Groups Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Read More
Logged-On User Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects password change for the logged-on user's via "ksetup.exe"

Read More
LOL-Binary Copied From System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

Read More
LOLBAS Data Exfiltration by DataSvcUtil.exe

Aug 12, 2024 · attack.exfiltration attack.t1567 ·
Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Read More
LOLBIN Execution From Abnormal Drive

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

Read More
Lolbin Runexehelper Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Read More
Lolbin Unregmp2.exe Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

Read More
LSA PPL Protection Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.010 ·
Share on:

Detects the usage of the "reg.exe" utility to disable PPL protection on the LSA process

Read More
LSASS Dump Keyword In CommandLine

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Read More
LSASS Process Reconnaissance Via Findstr.EXE

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Read More
Malicious Base64 Encoded PowerShell Keywords in Command Lines

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Read More
Malicious PE Execution by Microsoft Visual Studio Debugger

Aug 12, 2024 · attack.t1218 attack.defense-evasion ·
Share on:

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

Read More
Malicious Windows Script Components File Execution by TAEF Detection

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

Read More
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·
Share on:

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Read More
Microsoft IIS Connection Strings Decryption

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Read More
Microsoft IIS Service Account Password Dumped

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Read More
MMC Spawning Windows Shell

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 ·
Share on:

Detects a Windows command line executable started from MMC

Read More
MMC20 Lateral Movement

Aug 12, 2024 · attack.execution attack.t1021.003 ·
Share on:

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Read More
Modify Group Policy Settings

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Monitoring For Persistence Via BITS

Aug 12, 2024 · attack.defense-evasion attack.t1197 ·
Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

Read More
MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·
Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Read More
Mshtml.DLL RunHTMLApplication Suspicious Usage

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

Read More
MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·
Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Read More
Mstsc.EXE Execution From Uncommon Parent

Aug 12, 2024 · attack.lateral-movement ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Read More
Msxsl.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

Read More
Net WebClient Casing Anomalies

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Read More
Netsh Allow Group Policy on Microsoft Defender Firewall

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Adversaries may modify system firewalls in order to bypass controls limiting network usage

Read More
Network Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·
Share on:

Detects a set of suspicious network related commands often used in recon stages

Read More
New ActiveScriptEventConsumer Created Via Wmic.EXE

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Read More
New DLL Registered Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

Read More
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New Firewall Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0246 ·
Share on:

Detects the addition of a new rule to the Windows firewall via netsh

Read More
New Generic Credentials Added Via Cmdkey.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.005 ·
Share on:

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

Read More
New Kernel Driver Via SC.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
New Network Trace Capture Started Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detects the execution of netsh with the "trace" flag in order to start a network capture

Read More
New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Read More
New Process Created Via Taskmgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

Read More
New Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects new process creation using WMIC via the "process call create" flag

Read More
New Remote Desktop Connection Initiated Via Mstsc.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
New Root Certificate Installed Via CertMgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
New Root Certificate Installed Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
New Service Creation Using PowerShell

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using powershell.

Read More
New Service Creation Using Sc.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using the "sc.exe" utility.

Read More
New User Created Via Net.EXE

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Identifies the creation of local users via the net.exe command.

Read More
New User Created Via Net.EXE With Never Expire Option

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects creation of local users via the net.exe command with the option "never expire"

Read More
New Virtual Smart Card Created Via TpmVscMgr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.

Read More
Nltest.EXE Execution

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·
Share on:

Detects nltest commands that can be used for information discovery

Read More
Node Process Executions

Aug 12, 2024 · attack.defense-evasion attack.t1127 attack.t1059.007 ·
Share on:

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Read More
Non Interactive PowerShell Process Spawned

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Read More
Nslookup PowerShell Download Cradle - ProcessCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

Read More
NtdllPipe Like Activity Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

Read More
Obfuscated IP Download Activity

Aug 12, 2024 · attack.discovery ·
Share on:

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Read More
Odbcconf.EXE Suspicious DLL Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

Read More
OpenWith.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

The OpenWith.exe executes other binary

Read More
Operator Bloopers Cobalt Strike Commands

Aug 12, 2024 · attack.execution attack.t1059.003 stp.1u ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Operator Bloopers Cobalt Strike Modules

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled

Aug 12, 2024 · attack.execution attack.t1059 attack.t1202 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
PDQ Deploy Remote Adminstartion Tool Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·
Share on:

Detect use of PDQ Deploy remote admin tool

Read More
Perl Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Read More
Persistence Via Sticky Key Backdoor

Aug 12, 2024 · attack.t1546.008 attack.privilege-escalation ·
Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Read More
Persistence Via TypedPaths - CommandLine

Aug 12, 2024 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

Read More
Phishing Pattern ISO in Archive

Aug 12, 2024 · attack.initial-access attack.t1566 ·
Share on:

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Read More
Php Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Read More
Ping Hex IP

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1027 ·
Share on:

Detects a ping command that uses a hex encoded IP address

Read More
PktMon.EXE Execution

Aug 12, 2024 · attack.credential-access attack.t1040 ·
Share on:

Detects execution of PktMon, a tool that captures network packets.

Read More
Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Potential Active Directory Enumeration Using AD Module - ProcCreation

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·
Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Read More
Potential Adplus.EXE Abuse

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1003.001 ·
Share on:

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Read More
Potential Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential AMSI Bypass Using NULL Bits

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Read More
Potential Application Whitelisting Bypass via Dnx.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1027.004 ·
Share on:

Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.

Read More
Potential Arbitrary Code Execution Via Node.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Read More
Potential Arbitrary Command Execution Using Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

Read More
Potential Arbitrary Command Execution Via FTP.EXE

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Read More
Potential Arbitrary DLL Load Using Winword

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

Read More
Potential Arbitrary File Download Using Office Application

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects potential arbitrary file download using a Microsoft Office application

Read More
Potential Arbitrary File Download Via Cmdl32.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.

Read More
Potential Binary Impersonating Sysinternals Tools

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection

Read More
Potential Binary Proxy Execution Via Cdb.EXE

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1218 attack.t1127 ·
Share on:

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Read More
Potential Binary Proxy Execution Via VSDiagnostics.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.

Read More
Potential Browser Data Stealing

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Potential CobaltStrike Process Patterns

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects potential process patterns related to Cobalt Strike beacon activity

Read More
Potential COM Objects Download Cradles Usage - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Read More
Potential Command Line Path Traversal Evasion Attempt

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

Read More
Potential Commandline Obfuscation Using Escape Characters

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects potential commandline obfuscation using known escape characters

Read More
Potential CommandLine Path Traversal Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Read More
Potential Configuration And Service Reconnaissance Via Reg.EXE

Aug 12, 2024 · attack.discovery attack.t1012 attack.t1007 ·
Share on:

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

Read More
Potential Cookies Session Hijacking

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - CLI

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Potential Credential Dumping Via LSASS Process Clone

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.001 ·
Share on:

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Read More
Potential Credential Dumping Via WER

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

Read More
Potential Crypto Mining Activity

Aug 12, 2024 · attack.impact attack.t1496 ·
Share on:

Detects command line parameters or strings often used by crypto miners

Read More
Potential Data Exfiltration Activity Via CommandLine Tools

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Read More
Potential Data Stealing Via Chromium Headless Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·
Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Read More
Potential Defense Evasion Via Binary Rename

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Potential Discovery Activity Via Dnscmd.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1543.003 ·
Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Read More
Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Read More
Potential DLL Injection Or Execution Using Tracker.exe

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·
Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Read More
Potential DLL Sideloading Via DeviceEnroller.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Potential Dosfuscation Activity

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects possible payload obfuscation via the commandline

Read More
Potential Download/Upload Activity Using Type Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Read More
Potential Encoded PowerShell Patterns In CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Read More
Potential Execution of Sysinternals Tools

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Read More
Potential Fake Instance Of Hxtsr.EXE Executed

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe

Read More
Potential File Overwrite Via Sysinternals SDelete

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects the use of SDelete to erase a file not the free space

Read More
Potential Homoglyph Attack Using Lookalike Characters

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1036.003 ·
Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Read More
Potential LethalHTA Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·
Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Read More
Potential LSASS Process Dump Via Procdump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.credential-access attack.t1003.001 car.2013-05-009 ·
Share on:

Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable.

Read More
Potential Manage-bde.wsf Abuse To Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution

Read More
Potential Memory Dumping Activity Via LiveKD

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of LiveKD based on PE metadata or image name

Read More
Potential Meterpreter/CobaltStrike Activity

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read More
Potential Mftrace.EXE Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Read More
Potential Mpclient.DLL Sideloading Via Defender Binaries

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.

Read More
Potential MsiExec Masquerading

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects the execution of msiexec.exe from an uncommon directory

Read More
Potential MSTSC Shadowing Activity

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 ·
Share on:

Detects RDP session hijacking by using MSTSC shadowing

Read More
Potential Network Sniffing Activity Using Network Tools

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
Potential NTLM Coercion Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects possible NTLM coercion via certutil using the 'syncwithWU' flag

Read More
Potential Obfuscated Ordinal Call Via Rundll32

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of "rundll32" with potential obfuscated ordinal calls

Read More
Potential Password Spraying Attempt Using Dsacls.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects possible password spraying attempts using Dsacls

Read More
Potential Persistence Attempt Via Existing Service Tampering

Aug 12, 2024 · attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential Persistence Attempt Via Run Keys Using Reg.EXE

Aug 12, 2024 · attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Read More
Potential Persistence Via Logon Scripts - CommandLine

Aug 12, 2024 · attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Microsoft Compatibility Appraiser

Aug 12, 2024 · attack.persistence attack.t1053.005 ·
Share on:

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Read More
Potential Persistence Via Netsh Helper DLL

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Read More
Potential PowerShell Command Line Obfuscation

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1027 attack.t1059.001 ·
Share on:

Detects the PowerShell command lines with special characters

Read More
Potential PowerShell Downgrade Attack

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Read More
Potential PowerShell Execution Policy Tampering - ProcCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

Read More
Potential PowerShell Execution Via DLL

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.

Read More
Potential PowerShell Obfuscation Via Reversed Commands

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Read More
Potential PowerShell Obfuscation Via WCHAR

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects suspicious encoded character syntax often used for defense evasion

Read More
Potential Powershell ReverseShell Connection

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Read More
Potential Privilege Escalation To LOCAL SYSTEM

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Potential Process Execution Proxy Via CL_Invocation.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Read More
Potential Process Injection Via Msra.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Read More
Potential Product Class Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Potential Product Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Potential Provisioning Registry Key Abuse For Binary Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Read More
Potential Provlaunch.EXE Binary Proxy Execution Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Read More
Potential PsExec Remote Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

Read More
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.persistence attack.t1542.003 ·
Share on:

Detects potential malicious and unauthorized usage of bcdedit.exe

Read More
Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of plink to perform data exfiltration and tunneling

Read More
Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Read More
Potential Recon Activity Using DriverQuery.EXE

Aug 12, 2024 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

Read More
Potential Recon Activity Via Nltest.EXE

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1482 ·
Share on:

Detects nltest commands that can be used for information discovery

Read More
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to look for cached credentials on the system

Read More
Potential ReflectDebugger Content Execution Via WerFault.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036 ·
Share on:

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

Read More
Potential Register_App.Vbs LOLScript Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.

Read More
Potential Regsvr32 Commandline Flag Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

Read More
Potential Remote Desktop Tunneling

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·
Share on:

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Read More
Potential Renamed Rundll32 Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Read More
Potential Rundll32 Execution With DLL Stored In ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

Read More
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Read More
Potential ShellDispatch.DLL Functionality Abuse

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"

Read More
Potential Shim Database Persistence via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Potential Signing Bypass Via Windows Developer Features

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Read More
Potential SMB Relay Attack Tool Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·
Share on:

Detects different hacktools used for relay attacks on Windows for privilege escalation

Read More
Potential SPN Enumeration Via Setspn.EXE

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·
Share on:

Detects service principal name (SPN) enumeration used for Kerberoasting

Read More
Potential Suspicious Activity Using SeCEdit

Aug 12, 2024 · attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential Suspicious Browser Launch From Document Reader Process

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Read More
Potential Suspicious Mofcomp Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

Read More
Potential Suspicious Registry File Imported Via Reg.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility

Read More
Potential Suspicious Windows Feature Enabled - ProcCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Potential SysInternals ProcDump Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Read More
Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Read More
Potential Tampering With Security Products Via WMIC

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects uninstallation or termination of security products using the WMIC utility

Read More
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

Read More
Potential WinAPI Calls Via CommandLine

Aug 12, 2024 · attack.execution attack.t1106 ·
Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Read More
Potential Windows Defender AV Bypass Via Dump64.EXE Rename

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·
Share on:

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

Read More
Potential Windows Defender Tampering Via Wmic.EXE

Aug 12, 2024 · attack.credential-access attack.t1546.008 ·
Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Read More
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Read More
Potentially Over Permissive Permissions Granted Using Dsacls.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects usage of Dsacls to grant over permissive permissions

Read More
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Read More
Potentially Suspicious Call To Win32_NTEventlogFile Class

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Read More
Potentially Suspicious Child Process Of ClickOnce Application

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects potentially suspicious child processes of a ClickOnce deployment application

Read More
Potentially Suspicious Child Process Of DiskShadow.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.002 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Potentially Suspicious Child Process Of Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects potentially suspicious child processes of "regsvr32.exe".

Read More
Potentially Suspicious Child Process Of WinRAR.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Read More
Potentially Suspicious CMD Shell Output Redirect

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Read More
Potentially Suspicious DLL Registered Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

Read More
Potentially Suspicious Event Viewer Child Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Read More
Potentially Suspicious Execution From Parent Process In Public Folder

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1564 attack.t1059 ·
Share on:

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

Read More
Potentially Suspicious Execution Of PDQDeployRunner

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Read More
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location

Read More
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.

Read More
Potentially Suspicious GoogleUpdate Child Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects potentially suspicious child processes of "GoogleUpdate.exe"

Read More
Potentially Suspicious Ping/Copy Command Combination

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Read More
Potentially Suspicious Regsvr32 HTTP IP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

Read More
Potentially Suspicious Regsvr32 HTTP/FTP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.

Read More
Potentially Suspicious Rundll32 Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities

Read More
Potentially Suspicious Usage Of Qemu

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.t1572 ·
Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Read More
Potentially Suspicious WebDAV LNK Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
Potentially Suspicious Windows App Activity

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Read More
PowerShell Base64 Encoded FromBase64String Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Read More
PowerShell Base64 Encoded IEX Cmdlet

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

Read More
PowerShell Base64 Encoded Invoke Keyword

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Read More
Powershell Base64 Encoded MpPreference Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

Read More
PowerShell Base64 Encoded Reflective Assembly Load

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 attack.t1620 ·
Share on:

Detects base64 encoded .NET reflective loading of Assembly

Read More
PowerShell Base64 Encoded WMI Classes

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Read More
Powershell Defender Disable Scan Feature

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects requests to disable Microsoft Defender features using PowerShell commands

Read More
Powershell Defender Exclusion

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets

Read More
PowerShell Download and Execution Cradles

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects PowerShell download and execution cradles.

Read More
PowerShell Download Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a Powershell process that contains download commands in its command line string

Read More
PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·
Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Read More
Powershell Executed From Headless ConHost Process

Aug 12, 2024 · attack.defense-evasion attack.t1059.001 attack.t1059.003 ·
Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Read More
PowerShell Get-Clipboard Cmdlet Via CLI

Aug 12, 2024 · attack.collection attack.t1115 ·
Share on:

Detects usage of the 'Get-Clipboard' cmdlet via CLI

Read More
PowerShell Get-Process LSASS

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·
Share on:

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Read More
Powershell Inline Execution From A File

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects inline execution of PowerShell code from a file

Read More
PowerShell SAM Copy

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·
Share on:

Detects suspicious PowerShell scripts accessing SAM hives

Read More
PowerShell Script Change Permission Via Set-Acl

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects PowerShell execution to set the ACL of a file or a folder

Read More
PowerShell Script Run in AppData

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

Read More
PowerShell Set-Acl On Windows Folder

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects PowerShell scripts to set the ACL to a file in the Windows folder

Read More
Powershell Token Obfuscation - Process Creation

Aug 12, 2024 · attack.defense-evasion attack.t1027.009 ·
Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Read More
PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects suspicious ways to download files or content using PowerShell

Read More
PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Read More
Private Keys Reconnaissance Via CommandLine Tools

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·
Share on:

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Read More
Privilege Escalation via Named Pipe Impersonation

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·
Share on:

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Read More
Procdump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects usage of the SysInternals Procdump utility

Read More
Process Access via TrolleyExpress Exclusion

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 attack.credential-access attack.t1003.001 ·
Share on:

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Read More
Process Creation Using Sysnative Folder

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Read More
Process Execution From A Potentially Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a potentially suspicious execution from an uncommon folder.

Read More
Process Launched Without Image Name

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.

Read More
Process Memory Dump Via Comsvcs.DLL

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 car.2013-05-009 ·
Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Read More
Process Memory Dump Via Dotnet-Dump

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.

Read More
Process Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of "wmic" with the "process" flag, which adversary might use to list processes running on the compromised host or list installed software hotfixes and patches.

Read More
Proxy Execution Via Wuauclt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Read More
Psexec Execution

Aug 12, 2024 · attack.execution attack.t1569 attack.t1021 ·
Share on:

Detects user accept agreement execution in psexec commandline

Read More
PsExec Service Child Process Execution as LOCAL SYSTEM

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Read More
PsExec Service Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution

Read More
PsExec/PAExec Escalation to LOCAL SYSTEM

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·
Share on:

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

Read More
PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of 3proxy, a tiny free proxy server

Read More
PUA - AdFind Suspicious Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·
Share on:

Detects AdFind execution with common flags seen used during attacks

Read More
PUA - Adidnsdump Execution

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP

Read More
PUA - Advanced IP Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Read More
PUA - Advanced Port Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced Port Scanner.

Read More
PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - AdvancedRun Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Read More
PUA - Chisel Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

Read More
PUA - CleanWipe Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.

Read More
PUA - Crassus Execution

Aug 12, 2024 · attack.discovery attack.t1590.001 ·
Share on:

Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.

Read More
PUA - CsExec Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 attack.execution attack.t1569.002 ·
Share on:

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

Read More
PUA - DefenderCheck Execution

Aug 12, 2024 · attack.defense-evasion attack.t1027.005 ·
Share on:

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

Read More
PUA - DIT Snapshot Viewer

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

Read More
PUA - Mouse Lock Execution

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·
Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Read More
PUA - Netcat Suspicious Execution

Aug 12, 2024 · attack.command-and-control attack.t1095 ·
Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Read More
PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

Read More
PUA - NirCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Read More
PUA - NirCmd Execution As LOCAL SYSTEM

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution as SYSTEM user

Read More
PUA - Nmap/Zenmap Execution

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Read More
PUA - NSudo Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NSudo tool for command execution

Read More
PUA - Potential PE Metadata Tamper Using Rcedit

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·
Share on:

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Read More
PUA - Radmin Viewer Utility Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·
Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

Read More
PUA - Rclone Execution

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Read More
PUA - RunXCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

Read More
PUA - Seatbelt Execution

Aug 12, 2024 · attack.discovery attack.t1526 attack.t1087 attack.t1083 ·
Share on:

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Read More
PUA - SoftPerfect Netscan Execution

Aug 12, 2024 · attack.discovery attack.t1046 ·
Share on:

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Read More
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Aug 12, 2024 · attack.discovery attack.t1087.002 ·
Share on:

Detects active directory enumeration activity using known AdFind CLI flags

Read More
PUA - WebBrowserPassView Execution

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·
Share on:

Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera

Read More
PUA - Wsudo Suspicious Execution

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1059 ·
Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Read More
Pubprn.vbs Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·
Share on:

Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.

Read More
Python Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Read More
Python Spawning Pretty TTY on Windows

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects python spawning a pretty tty

Read More
Query Usage To Exfil Data

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Read More
Raccine Uninstall

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.

Read More
Rar Usage with Password and Compression Level

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

Read More
RDP Connection Allowed Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

Read More
RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Read More
Read Contents From Stdin Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detect the use of "<" to read and potentially execute a file via cmd.exe

Read More
Rebuild Performance Counter Values Via Lodctr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Read More
Recon Command Output Piped To Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1057 ·
Share on:

Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Read More
Recon Information for Export with Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
Reg Add Suspicious Paths

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562.001 ·
Share on:

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Read More
Regedit as Trusted Installer

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Read More
REGISTER_APP.VBS Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.

Read More
Registry Modification Via Regini.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Read More
Regsvr32 DLL Execution With Suspicious File Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects the execution of REGSVR32.exe with DLL files masquerading as other files

Read More
Regsvr32 DLL Execution With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1574 attack.execution ·
Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read More
Regsvr32 Execution From Highly Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

Read More
Regsvr32 Execution From Potential Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.

Read More
Remote Access Tool - AnyDesk Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - Anydesk Execution From Suspicious Folder

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Aug 12, 2024 · attack.execution attack.initial-access ·
Share on:

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Read More
Remote Access Tool - AnyDesk Piped Password Via CLI

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Read More
Remote Access Tool - AnyDesk Silent Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Read More
Remote Access Tool - GoToAssist Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - LogMeIn Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - NetSupport Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - RURAT Execution From Unusual Location

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')

Read More
Remote Access Tool - ScreenConnect Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - ScreenConnect Installation Execution

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects ScreenConnect program starts that establish a remote access to a system.

Read More
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Read More
Remote Access Tool - ScreenConnect Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Read More
Remote Access Tool - ScreenConnect Server Web Shell Execution

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential web shell execution from the ScreenConnect server process.

Read More
Remote Access Tool - Simple Help Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - Team Viewer Session Started On Windows Host

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - UltraViewer Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Code Execute via Winrm.vbs

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects an attempt to execute code or create service on remote host via winrm.vbs.

Read More
Remote File Download Via Desktopimgdownldr Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Read More
Remote File Download Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Read More
Remote PowerShell Session Host Process (WinRM)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1021.006 ·
Share on:

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

Read More
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.

Read More
Remotely Hosted HTA File Executed Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.005 ·
Share on:

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Read More
Renamed AutoHotkey.EXE Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of a renamed autohotkey.exe binary based on PE metadata fields

Read More
Renamed BOINC Client Execution

Aug 12, 2024 · attack.defense-evasion attack.t1553 ·
Share on:

Detects the execution of a renamed BOINC binary.

Read More
Renamed BrowserCore.EXE Execution

Aug 12, 2024 · attack.t1528 attack.t1036.003 ·
Share on:

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Read More
Renamed CreateDump Utility Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Read More
Renamed FTP.EXE Execution

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Read More
Renamed Gpg.EXE Execution

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Read More
Renamed Jusched.EXE Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

Read More
Renamed Mavinject.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More
Renamed MegaSync Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.

Read More
Renamed Microsoft Teams Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed Microsoft Teams binary.

Read More
Renamed Msdt.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "Msdt.exe" binary

Read More
Renamed NirCmd.EXE Execution

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Read More
Renamed Office Binary Execution

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed office binary

Read More
Renamed Plink Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of a renamed version of the Plink binary

Read More
Renamed ProcDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms.

Read More
Renamed PsExec Service Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

Read More
Renamed Remote Utilities RAT (RURAT) Execution

Aug 12, 2024 · attack.defense-evasion attack.collection attack.command-and-control attack.discovery attack.s0592 ·
Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Read More
Renamed SysInternals DebugView Execution

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·
Share on:

Detects suspicious renamed SysInternals DebugView execution

Read More
Renamed Sysinternals Sdelete Execution

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Read More
Renamed Visual Studio Code Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Renamed Vmnat.exe Execution

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Read More
Renamed Whoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami that has been renamed to a different name to avoid detection

Read More
Renamed ZOHO Dctask64 Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·
Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Replace.exe Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Read More
Response File Execution Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Read More
Root Certificate Installed From Susp Locations

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
Ruby Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Read More
Run Once Task Execution as Configured in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

This rule detects the execution of Run Once task as configured in the registry

Read More
Run PowerShell Script from ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects PowerShell script execution from Alternate Data Stream (ADS)

Read More
Run PowerShell Script from Redirected Input Stream

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects PowerShell script execution via input stream redirect

Read More
Rundll32 Execution With Uncommon DLL Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the execution of rundll32 with a command line that doesn't contain a common extension

Read More
Rundll32 Execution Without CommandLine Parameters

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Read More
Rundll32 Execution Without Parameters

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Read More
Rundll32 InstallScreenSaver Execution

Aug 12, 2024 · attack.t1218.011 attack.defense-evasion ·
Share on:

An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver

Read More
Rundll32 Registered COM Objects

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

load malicious registered COM objects

Read More
Rundll32 Spawned Via Explorer.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.

Read More
RunDLL32 Spawning Explorer

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

Read More
Rundll32 UNC Path Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1021.002 attack.t1218.011 ·
Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

Read More
SafeBoot Registry Key Deleted Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Read More
Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
Scheduled Task Executing Encoded Payload from Registry

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task Executing Payload from Registry

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Schtasks From Suspicious Folders

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
Screen Capture Activity Via Psr.EXE

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.

Read More
Script Event Consumer Spawning Process

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Read More
Script Interpreter Execution From Suspicious Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Read More
Scripting/CommandLine Process Spawned Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.

Read More
Sdclt Child Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·
Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Security Privileges Enumeration Via Whoami.EXE

Aug 12, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Read More
Security Service Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" to disable security services such as Windows Defender.

Read More
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

Read More
Sensitive File Access Via Volume Shadow Copy Backup

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)

Read More
Sensitive File Dump Via Wbadmin.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Read More
Sensitive File Recovery From Backup Via Wbadmin.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Read More
Service DACL Abuse To Hide Services Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Read More
Service Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Read More
Service Registry Key Deleted Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

Read More
Service Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Read More
Service Started/Stopped Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects usage of wmic to start or stop a service

Read More
Service StartupType Change Via PowerShell Set-Service

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Read More
Service StartupType Change Via Sc.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"

Read More
Set Suspicious Files as System Files Using Attrib.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Read More
Shadow Copies Creation Using Operating Systems Utilities

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Read More
Share And Session Enumeration Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1018 ·
Share on:

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Read More
Shell Process Spawned by Java.EXE

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
Shell32 DLL Execution in Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 ·
Share on:

Detects shell32.dll executing a DLL in a suspicious directory

Read More
ShimCache Flush

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects actions that clear the local ShimCache and remove forensic evidence

Read More
SQL Client Tools PowerShell Session Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
SQLite Chromium Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Read More
SQLite Firefox Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Read More
Start of NT Virtual DOS Machine

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications

Read More
Start Windows Service Via Net.EXE

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects the usage of the "net.exe" command to start a service using the "start" flag

Read More
Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Stop Windows Service Via Net.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "net" utility.

Read More
Stop Windows Service Via PowerShell Stop-Service

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

Read More
Stop Windows Service Via Sc.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "sc.exe" utility

Read More
Suspect Svchost Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Read More
Suspicious Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory.

Read More
Suspicious Advpack Call Via Rundll32.EXE

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function

Read More
Suspicious AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
Suspicious Binary In User Directory Spawned From Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Cabinet File Execution Via Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190

Read More
Suspicious Calculator Usage

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

Read More
Suspicious Certreq Command to Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Read More
Suspicious Child Process of AspNetCompiler

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects potentially suspicious child processes of "aspnet_compiler.exe".

Read More
Suspicious Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Suspicious Child Process Of Manage Engine ServiceDesk

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Read More
Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Child Process Of Veeam Dabatase

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious CodePage Switch Via CHCP

Aug 12, 2024 · attack.t1036 attack.defense-evasion ·
Share on:

Detects a code page switch in command line or batch scripts to a rare language

Read More
Suspicious Command Patterns In Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Read More
Suspicious Control Panel DLL Load

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

Read More
Suspicious Copy From or To System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

Read More
Suspicious Csi.exe Usage

Aug 12, 2024 · attack.execution attack.t1072 attack.defense-evasion attack.t1218 ·
Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Read More
Suspicious Curl.EXE Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Read More
Suspicious CustomShellHost Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the execution of CustomShellHost binary where the child isn't located in 'C:\Windows\explorer.exe'

Read More
Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·
Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Read More
Suspicious Desktopimgdownldr Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Read More
Suspicious Diantz Alternate Data Stream Execution

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.

Read More
Suspicious Diantz Download and Compress Into a CAB File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Download and compress a remote file and store it in a cab file on local machine.

Read More
Suspicious DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to load the target DLL file.

Read More
Suspicious Double Extension File Execution

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Read More
Suspicious Download From Direct IP Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Read More
Suspicious Download from Office Domain

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.t1608 ·
Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Read More
Suspicious Download Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files.

Read More
Suspicious Driver Install by pnputil.exe

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Read More
Suspicious Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

Read More
Suspicious DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious ways to use the "DumpMinitool.exe" binary

Read More
Suspicious Electron Application Child Processes

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

Read More
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1027 ·
Share on:

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

Read More
Suspicious Encoded PowerShell Command Line

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Read More
Suspicious Eventlog Clearing or Configuration Change Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070.001 attack.t1562.002 car.2016-04-002 ·
Share on:

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

Read More
Suspicious Execution From Outlook Temporary Folder

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·
Share on:

Detects a suspicious program execution in Outlook temp folder

Read More
Suspicious Execution Location Of Wermgr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

Read More
Suspicious Execution of Hostname

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Use of hostname to get information

Read More
Suspicious Execution of InstallUtil Without Log

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Uses the .NET InstallUtil.exe application in order to execute image without log

Read More
Suspicious Execution of Powershell with Base64

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Commandline to launch powershell with a base64 payload

Read More
Suspicious Execution of Shutdown

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Use of the commandline to shutdown or reboot windows

Read More
Suspicious Execution of Shutdown to Log Out

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Detects the rare use of the command line tool shutdown to logoff a user

Read More
Suspicious Execution of Systeminfo

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects usage of the "systeminfo" command to retrieve information

Read More
Suspicious Extrac32 Alternate Data Stream Execution

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Extract data from cab file and hide it in an alternate data stream

Read More
Suspicious Extrac32 Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Download or Copy file with Extrac32

Read More
Suspicious File Characteristics Due to Missing Fields

Aug 12, 2024 · attack.execution attack.t1059.006 ·
Share on:

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Read More
Suspicious File Download From IP Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Read More
Suspicious File Download From IP Via Wget.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

Read More
Suspicious File Download From IP Via Wget.EXE - Paths

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Read More
Suspicious File Downloaded From Direct IP Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Read More
Suspicious File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

Read More
Suspicious File Execution From Internet Hosted WebDav Share

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Read More
Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Read More
Suspicious Git Clone

Aug 12, 2024 · attack.reconnaissance attack.t1593.003 ·
Share on:

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Read More
Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 ·
Share on:

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Read More
Suspicious GrpConv Execution

Aug 12, 2024 · attack.persistence attack.t1547 ·
Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Read More
Suspicious GUP Usage

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Read More
Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Read More
Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·
Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Read More
Suspicious IIS Module Registration

Aug 12, 2024 · attack.persistence attack.t1505.004 ·
Share on:

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Read More
Suspicious IIS URL GlobalRules Rewrite Via AppCmd

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.

Read More
Suspicious Invoke-WebRequest Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Read More
Suspicious Invoke-WebRequest Execution With DirectIP

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Read More
Suspicious JavaScript Execution Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·
Share on:

Detects execution of javascript code using "mshta.exe".

Read More
Suspicious Kernel Dump Using Dtrace

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Read More
Suspicious Key Manager Access

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·
Share on:

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Read More
Suspicious Manipulation Of Default Accounts Via Net.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Read More
Suspicious Microsoft Office Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Suspicious Microsoft OneNote Child Process

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access ·
Share on:

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Read More
Suspicious Modification Of Scheduled Tasks

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious Msbuild Execution By Uncommon Parent Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process

Read More
Suspicious MSDT Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·
Share on:

Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation

Read More
Suspicious MSHTA Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·
Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Read More
Suspicious Mshta.EXE Execution Patterns

Aug 12, 2024 · attack.execution attack.t1106 ·
Share on:

Detects suspicious mshta process execution patterns

Read More
Suspicious MsiExec Embedding Parent

Aug 12, 2024 · attack.t1218.007 attack.defense-evasion ·
Share on:

Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads

Read More
Suspicious Msiexec Execute Arbitrary DLL

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Suspicious Msiexec Quiet Install From Remote Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Read More
Suspicious Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
Suspicious Network Command

Aug 12, 2024 · attack.discovery attack.t1016 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Suspicious New Service Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Read More
Suspicious NTLM Authentication on the Printer Spooler Service

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1212 ·
Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Read More
Suspicious Obfuscated PowerShell Code

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines

Read More
Suspicious Outlook Child Process

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects a suspicious process spawning from an Outlook process.

Read More
Suspicious Parent Double Extension File Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detect execution of suspicious double extension files in ParentCommandLine

Read More
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Read More
Suspicious Ping/Del Command Combination

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Read More
Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·
Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Read More
Suspicious Powercfg Execution To Change Lock Screen Timeout

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout

Read More
Suspicious PowerShell Download and Execute Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Read More
Suspicious PowerShell Encoded Command Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Read More
Suspicious PowerShell IEX Execution Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Read More
Suspicious PowerShell Invocation From Script Engines

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell invocations from interpreters or unusual programs

Read More
Suspicious PowerShell Invocations - Specific - ProcessCreation

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Mailbox Export to Share

Aug 12, 2024 · attack.exfiltration ·
Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Read More
Suspicious PowerShell Parameter Substring

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation with a parameter substring

Read More
Suspicious PowerShell Parent Process

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Read More
Suspicious Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Read More
Suspicious Process Masquerading As SvcHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.

Read More
Suspicious Process Parents

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects suspicious parent processes that should not have any children or should only have a single possible child program

Read More
Suspicious Process Start Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036 car.2013-05-002 ·
Share on:

Detects suspicious process run from unusual locations

Read More
Suspicious Processes Spawned by WinRM

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Read More
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

Read More
Suspicious Program Names

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Read More
Suspicious Provlaunch.EXE Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Read More
Suspicious Query of MachineGUID

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Use of reg to get MachineGuid information

Read More
Suspicious RASdial Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects suspicious process related to rasdial.exe

Read More
Suspicious RDP Redirect Using TSCON

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects a suspicious RDP session redirect using tscon.exe

Read More
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

Aug 12, 2024 · attack.discovery attack.t1087.001 ·
Share on:

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Read More
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Suspicious Recursive Takeown

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·
Share on:

Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

Read More
Suspicious Redirection to Local Admin Share

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Read More
Suspicious Reg Add BitLocker

Aug 12, 2024 · attack.impact attack.t1486 ·
Share on:

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Read More
Suspicious Reg Add Open Command

Aug 12, 2024 · attack.credential-access attack.t1003 ·
Share on:

Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key

Read More
Suspicious Registry Modification From ADS Via Regini.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

Read More
Suspicious Regsvr32 Execution From Remote Share

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects REGSVR32.exe to execute DLL hosted on remote shares

Read More
Suspicious Remote Child Process From Outlook

Aug 12, 2024 · attack.execution attack.t1059 attack.t1202 ·
Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Read More
Suspicious Response File Execution Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Read More
Suspicious RunAs-Like Flag Combination

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Read More
Suspicious Rundll32 Activity Invoking Sys File

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

Read More
Suspicious Rundll32 Execution With Image Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the execution of Rundll32.exe with DLL files masquerading as image files

Read More
Suspicious Rundll32 Invoking Inline VBScript

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Read More
Suspicious Rundll32 Setupapi.dll Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Read More
Suspicious Runscripthelper.exe

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Read More
Suspicious Scan Loop Network

Aug 12, 2024 · attack.execution attack.t1059 attack.discovery attack.t1018 ·
Share on:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Read More
Suspicious Scheduled Task Creation Involving Temp Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Read More
Suspicious Scheduled Task Name As GUID

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Schtasks Execution AppData Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious ScreenSave Change by Reg.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Script Execution From Temp Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script executions from temporary folder

Read More
Suspicious Serv-U Process Pattern

Aug 12, 2024 · attack.credential-access attack.t1555 cve.2021-35211 ·
Share on:

Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

Read More
Suspicious Service Binary Directory

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects a service binary running in a suspicious directory

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet

Aug 12, 2024 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Read More
Suspicious Service Path Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Read More
Suspicious Shells Spawn by Java Utility Keytool

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Suspicious Splwow64 Without Params

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects suspicious Splwow64.exe process without any command line parameters

Read More
Suspicious SysAidServer Child

Aug 12, 2024 · attack.lateral-movement attack.t1210 ·
Share on:

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Read More
Suspicious SYSVOL Domain Group Policy Access

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·
Share on:

Detects Access to Domain Group Policies stored in SYSVOL

Read More
Suspicious TSCON Start as SYSTEM

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Read More
Suspicious UltraVNC Execution

Aug 12, 2024 · attack.lateral-movement attack.g0047 attack.t1021.005 ·
Share on:

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Read More
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Read More
Suspicious Use of CSharp Interactive Console

Aug 12, 2024 · attack.execution attack.t1127 ·
Share on:

Detects the execution of CSharp interactive console by PowerShell

Read More
Suspicious Use of PsLogList

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·
Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Read More
Suspicious Userinit Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects a suspicious child process of userinit

Read More
Suspicious VBoxDrvInst.exe Parameters

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys

Read More
Suspicious Vsls-Agent Command With AgentExtensionPath Load

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter

Read More
Suspicious WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 cve.2023-23397 ·
Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Read More
Suspicious Where Execution

Aug 12, 2024 · attack.discovery attack.t1217 ·
Share on:

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Read More
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Read More
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Read More
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1070.001 ·
Share on:

Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

Read More
Suspicious Windows Update Agent Empty Cmdline

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

Read More
Suspicious WindowsTerminal Child Processes

Aug 12, 2024 · attack.execution attack.persistence ·
Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Read More
Suspicious WMIC Execution Via Office Process

Aug 12, 2024 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense-evasion ·
Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Read More
Suspicious WmiPrvSE Child Process

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Read More
Suspicious Workstation Locking via Rundll32

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects a suspicious call to the user32.dll function that locks the user workstation

Read More
Suspicious X509Enrollment - Process Creation

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detect use of X509Enrollment

Read More
Suspicious XOR Encoded PowerShell Command

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1140 attack.t1027 ·
Share on:

Detects presence of a potentially xor encoded powershell command

Read More
Suspicious ZipExec Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.

Read More
SyncAppvPublishingServer Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.

Read More
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1216 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs

Read More
Sysinternals PsService Execution

Aug 12, 2024 · attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Read More
Sysinternals PsSuspend Execution

Aug 12, 2024 · attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read More
Sysinternals PsSuspend Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Read More
Sysmon Configuration Update

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely

Read More
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1518.001 ·
Share on:

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

Read More
Sysmon Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Read More
Sysprep on AppData Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

Read More
System File Execution Location Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.

Read More
System Network Connections Discovery Via Net.EXE

Aug 12, 2024 · attack.discovery attack.t1049 ·
Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More
Tamper Windows Defender Remove-MpPreference

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet

Read More
Tap Installer Execution

Aug 12, 2024 · attack.exfiltration attack.t1048 ·
Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

Read More
Taskkill Symantec Endpoint Protection

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects one of the possible scenarios for disabling Symantec Endpoint Protection. Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism. As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.

Read More
Taskmgr as LOCAL_SYSTEM

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM

Read More
Tasks Folder Evasion

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.execution attack.t1574.002 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Terminal Service Process Spawn

Aug 12, 2024 · attack.initial-access attack.t1190 attack.lateral-movement attack.t1210 car.2013-07-002 ·
Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Read More
Time Travel Debugging Utility Usage

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1218 attack.t1003.001 ·
Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Read More
Tor Client/Browser Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

Read More
TrustedPath UAC Bypass Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·
Share on:

Detects indicators of a UAC bypass method by mocking directories

Read More
UAC Bypass Using Event Viewer RecentViews

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of UAC Bypass using Event Viewer RecentViews

Read More
UAC Bypass via ICMLuaUtil

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

Read More
UAC Bypass via Windows Firewall Snap-In Hijack

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read More
UEFI Persistence Via Wpbbin - ProcessCreation

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1542.001 ·
Share on:

Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

Read More
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".

Read More
Uncommon AddinUtil.EXE CommandLine Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.

Read More
Uncommon Child Process Of AddinUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.

Read More
Uncommon Child Process Of Appvlp.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·
Share on:

Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file.

Read More
Uncommon Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Uncommon Child Process Of Defaultpack.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·
Share on:

Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs

Read More
Uncommon Child Process Of Setres.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.

Read More
Uncommon Child Process Spawned By Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.

Read More
Uncommon Child Processes Of SndVol.exe

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)

Read More
Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Uncommon FileSystem Load Attempt By Format.com

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

Read More
Uncommon Link.EXE Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.

Read More
Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Uncommon Svchost Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects an uncommon svchost parent process

Read More
Uncommon Userinit Child Process

Aug 12, 2024 · attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Uninstall Crowdstrike Falcon Sensor

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

Read More
Uninstall Sysinternals Sysmon

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the removal of Sysmon, which could be a potential attempt at defense evasion

Read More
Unmount Share Via Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·
Share on:

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
Unusual Child Process of dns.exe

Aug 12, 2024 · attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Usage Of Web Request Commands And Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Read More
Use Icacls to Hide File to Everyone

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Read More
Use NTFS Short Name in Command Line

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Read More
Use NTFS Short Name in Image

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection

Read More
Use of FSharp Interpreters

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

Read More
Use of OpenConsole

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Read More
Use of Pcalua For Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Read More
Use of Remote.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.

Read More
Use of Scriptrunner.exe

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting

Read More
Use Of The SFTP.EXE Binary As A LOLBIN

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag

Read More
Use of TTDInject.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)

Read More
Use of UltraVNC Remote Access Software

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Read More
Use of VisualUiaVerifyNative.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Read More
Use of VSIISExeLauncher.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries

Read More
Use of W32tm as Timer

Aug 12, 2024 · attack.discovery attack.t1124 ·
Share on:

When configured with suitable command line arguments, w32tm can act as a delay mechanism

Read More
Use of Wfc.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Read More
Use Short Name Path in Command Line

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Read More
Use Short Name Path in Image

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

Read More
User Added To Highly Privileged Group

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

Read More
User Added to Local Administrators Group

Aug 12, 2024 · attack.persistence attack.t1098 ·
Share on:

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Read More
User Added to Remote Desktop Users Group

Aug 12, 2024 · attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Read More
User Discovery And Export Via Get-ADUser Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Read More
Using SettingSyncHost.exe as LOLBin

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1574.008 ·
Share on:

Detects using SettingSyncHost.exe to run hijacked binary

Read More
UtilityFunctions.ps1 Proxy Dll

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.

Read More
Veeam Backup Database Suspicious Query

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

Read More
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Aug 12, 2024 · attack.collection attack.t1005 ·
Share on:

Detects dump of credentials in VeeamBackup dbo

Read More
Verclsid.exe Runs COM Object

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when verclsid.exe is used to run COM object via GUID

Read More
Visual Basic Command Line Compiler Usage

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

Read More
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary

Read More
Visual Studio NodejsTools PressAnyKey Renamed Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries

Read More
VMToolsd Suspicious Child Process

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Read More
VolumeShadowCopy Symlink Creation Via Mklink

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies storage symbolic link creation using operating systems utilities

Read More
Wab Execution From Non Default Location

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

Read More
Wab/Wabmig Unusual Parent Or Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

Read More
Weak or Abused Passwords In CLI

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

Read More
WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·
Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).

Read More
Webshell Hacking Activity Patterns

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More
Webshell Tool Reconnaissance Activity

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

Read More
WhoAmI as Parameter

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Read More
Whoami Utility Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation

Read More
Windows Admin Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects when an admin share is mounted using net.exe

Read More
Windows Backup Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·
Share on:

Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Read More
Windows Credential Manager Access via VaultCmd

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·
Share on:

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Read More
Windows Defender Definition Files Removed

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

Read More
Windows Firewall Disabled via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects attempts to disable the Windows Firewall using PowerShell

Read More
Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

Read More
Windows Internet Hosted WebDav Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Read More
Windows Kernel Debugger Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of the Windows Kernel Debugger "kd.exe".

Read More
Windows Processes Suspicious Parent Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036.005 ·
Share on:

Detect suspicious parent processes of well-known Windows processes

Read More
Windows Recall Feature Enabled Via Reg.EXE

Aug 12, 2024 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Windows Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects when a share is mounted using the "net.exe" utility

Read More
Windows Shell/Scripting Processes Spawning Suspicious Programs

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·
Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Read More
Winrar Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Read More
Winrar Execution in Non-Standard Folder

Aug 12, 2024 · attack.collection attack.t1560.001 ·
Share on:

Detects a suspicious winrar execution in a folder which is not the default installation folder

Read More
Wlrmdr.EXE Uncommon Argument Or Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.

Read More
WMI Backdoor Exchange Transport Agent

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Read More
WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects WMI script event consumers

Read More
WMIC Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC to query information on a remote system

Read More
WmiPrvSE Spawned A Process

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects WmiPrvSE spawning a process

Read More
Write Protect For Storage Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.

Read More
Writing Of Malicious Files To The Fonts Folder

Aug 12, 2024 · attack.t1211 attack.t1059 attack.defense-evasion attack.persistence ·
Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Read More
Wscript Shell Run In CommandLine

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

Read More
WSL Child Process Anomaly

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL

Read More
XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

Read More
XSL Script Execution Via WMIC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of WMIC with the "format" flag to potentially load XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Read More