process_creation | Detection.FYI

Unusual Parent Process For Cmd.EXE

Dec 6, 2023 · attack.execution attack.t1059 ·
Share on:

Detects suspicious parent process for cmd.exe

Read More
HackTool - WinPwn Execution

Dec 4, 2023 · attack.credential_access attack.defense_evasion attack.discovery attack.execution attack.privilege_escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - Impacket Tools Execution

Dec 4, 2023 · attack.execution attack.t1557.001 ·
Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Read More
HackTool - winPEAS Execution

Dec 4, 2023 · attack.privilege_escalation attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
Potential Homoglyph Attack Using Lookalike Characters

Dec 4, 2023 · attack.defense_evasion attack.t1036 attack.t1036.003 ·
Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Read More
Writing Of Malicious Files To The Fonts Folder

Dec 4, 2023 · attack.t1211 attack.t1059 attack.defense_evasion attack.persistence ·
Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Read More
DirLister Execution

Dec 1, 2023 · attack.discovery attack.t1083 ·
Share on:

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Read More
Disable Windows IIS HTTP Logging

Dec 1, 2023 · attack.defense_evasion attack.t1562.002 ·
Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Read More
Disabled RestrictedAdminMode For RDS - ProcCreation

Dec 1, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Execution from Suspicious Folder

Dec 1, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects a suspicious execution from an uncommon folder

Read More
Fsutil Behavior Set SymlinkEvaluation

Dec 1, 2023 · attack.execution attack.t1059 ·
Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Read More
HackTool - HandleKatz LSASS Dumper Execution

Dec 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

Read More
HackTool - Htran/NATBypass Execution

Dec 1, 2023 · attack.command_and_control attack.t1090 attack.s0040 ·
Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Read More
HackTool - Inveigh Execution

Dec 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Read More
HackTool - KrbRelay Execution

Dec 1, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

Detects the use of KrbRelay, a Kerberos relaying tool

Read More
HackTool - KrbRelayUp Execution

Dec 1, 2023 · attack.credential_access attack.t1558.003 attack.lateral_movement attack.t1550.003 ·
Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More
HackTool - PowerTool Execution

Dec 1, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

Read More
HackTool - SafetyKatz Execution

Dec 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Read More
HackTool - SharPersist Execution

Dec 1, 2023 · attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
HackTool - SharpLdapWhoami Execution

Dec 1, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

Read More
HackTool - SysmonEOP Execution

Dec 1, 2023 · cve.2022.41120 attack.t1068 attack.privilege_escalation ·
Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Read More
Import PowerShell Modules From Suspicious Directories - ProcCreation

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Lolbin Ssh.exe Use As Proxy

Dec 1, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs

Read More
Microsoft IIS Service Account Password Dumped

Dec 1, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Read More
New Generic Credentials Added Via Cmdkey.EXE

Dec 1, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.

Read More
New Remote Desktop Connection Initiated Via Mstsc.EXE

Dec 1, 2023 · attack.lateral_movement attack.t1021.001 ·
Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
Nltest.EXE Execution

Dec 1, 2023 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·
Share on:

Detects nltest commands that can be used for information discovery

Read More
Operator Bloopers Cobalt Strike Commands

Dec 1, 2023 · attack.execution attack.t1059.003 stp.1u ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Operator Bloopers Cobalt Strike Modules

Dec 1, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Read More
PDQ Deploy Remote Adminstartion Tool Execution

Dec 1, 2023 · attack.execution attack.lateral_movement attack.t1072 ·
Share on:

Detect use of PDQ Deploy remote admin tool

Read More
Potential Active Directory Enumeration Using AD Module - ProcCreation

Dec 1, 2023 · attack.reconnaissance attack.discovery attack.impact ·
Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Read More
Potential Arbitrary Code Execution Via Node.EXE

Dec 1, 2023 · attack.defense_evasion attack.t1127 ·
Share on:

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - CLI

Dec 1, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Potential Discovery Activity Via Dnscmd.EXE

Dec 1, 2023 · attack.discovery attack.execution attack.t1543.003 ·
Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Read More
Potential DLL Sideloading Via DeviceEnroller.EXE

Dec 1, 2023 · attack.defense_evasion attack.t1574.002 ·
Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Potential Password Spraying Attempt Using Dsacls.EXE

Dec 1, 2023 · attack.execution attack.t1218 ·
Share on:

Detects possible password spraying attempts using Dsacls

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Dec 1, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential PowerShell Execution Policy Tampering - ProcCreation

Dec 1, 2023 · attack.defense_evasion ·
Share on:

Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

Read More
Potential Process Injection Via Msra.EXE

Dec 1, 2023 · attack.defense_evasion attack.t1055 ·
Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Read More
Potential RDP Tunneling Via SSH

Dec 1, 2023 · attack.command_and_control attack.t1572 ·
Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Read More
Potential Recon Activity Via Nltest.EXE

Dec 1, 2023 · attack.discovery attack.t1016 attack.t1482 ·
Share on:

Detects nltest commands that can be used for information discovery

Read More
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Dec 1, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to look for cached credentials on the system

Read More
Potential Renamed Rundll32 Execution

Dec 1, 2023 · attack.execution ·
Share on:

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Read More
Potential Signing Bypass Via Windows Developer Features

Dec 1, 2023 · attack.defense_evasion ·
Share on:

Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Read More
Potential WinAPI Calls Via CommandLine

Dec 1, 2023 · attack.execution attack.t1106 ·
Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Read More
Potentially Over Permissive Permissions Granted Using Dsacls.EXE

Dec 1, 2023 · attack.execution attack.t1218 ·
Share on:

Detects usage of Dsacls to grant over permissive permissions

Read More
Powershell Base64 Encoded MpPreference Cmdlet

Dec 1, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

Read More
PowerShell Base64 Encoded WMI Classes

Dec 1, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

Detects calls to base64 encoded WMI class such as "Win32_Shadowcopy", "Win32_ScheduledJob", etc.

Read More
PUA - DefenderCheck Execution

Dec 1, 2023 · attack.defense_evasion attack.t1027.005 ·
Share on:

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

Read More
PUA - Fast Reverse Proxy (FRP) Execution

Dec 1, 2023 · attack.command_and_control attack.t1090 ·
Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

Read More
PUA - NPS Tunneling Tool Execution

Dec 1, 2023 · attack.command_and_control attack.t1090 ·
Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

Read More
PUA - Seatbelt Execution

Dec 1, 2023 · attack.discovery attack.t1526 attack.t1087 attack.t1083 ·
Share on:

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Read More
Query Usage To Exfil Data

Dec 1, 2023 · attack.execution ·
Share on:

Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Read More
Renamed BrowserCore.EXE Execution

Dec 1, 2023 · attack.t1528 attack.t1036.003 ·
Share on:

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Read More
Renamed Mavinject.EXE Execution

Dec 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More
Renamed Msdt.EXE Execution

Dec 1, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "Msdt.exe" binary

Read More
Renamed NetSupport RAT Execution

Dec 1, 2023 · attack.defense_evasion ·
Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Read More
Renamed Plink Execution

Dec 1, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects the execution of a renamed version of the Plink binary

Read More
Renamed Remote Utilities RAT (RURAT) Execution

Dec 1, 2023 · attack.defense_evasion attack.collection attack.command_and_control attack.discovery attack.s0592 ·
Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Read More
Renamed Sysinternals Sdelete Execution

Dec 1, 2023 · attack.impact attack.t1485 ·
Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Read More
Renamed Vmnat.exe Execution

Dec 1, 2023 · attack.defense_evasion attack.t1574.002 ·
Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Read More
Root Certificate Installed From Susp Locations

Dec 1, 2023 · attack.defense_evasion attack.t1553.004 ·
Share on:

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
SafeBoot Registry Key Deleted Via Reg.EXE

Dec 1, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Read More
Service Registry Key Deleted Via Reg.EXE

Dec 1, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

Read More
SQLite Chromium Profile Data DB Access

Dec 1, 2023 · attack.credential_access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Read More
SQLite Firefox Profile Data DB Access

Dec 1, 2023 · attack.credential_access attack.t1539 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Read More
Suspicious Binary In User Directory Spawned From Office Application

Dec 1, 2023 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Git Clone

Dec 1, 2023 · attack.reconnaissance attack.t1593.003 ·
Share on:

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Read More
Suspicious Hacktool Execution - Imphash

Dec 1, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More
Suspicious Hacktool Execution - PE Metadata

Dec 1, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More
Suspicious IIS URL GlobalRules Rewrite Via AppCmd

Dec 1, 2023 · attack.defense_evasion ·
Share on:

Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.

Read More
Suspicious New Instance Of An Office COM Object

Dec 1, 2023 · attack.execution attack.defense_evasion ·
Share on:

Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)

Read More
Suspicious Rundll32 Script in CommandLine

Dec 1, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects suspicious process related to rundll32 based on arguments

Read More
Suspicious Shells Spawn by Java Utility Keytool

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Suspicious Use of PsLogList

Dec 1, 2023 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·
Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Read More
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Dec 1, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Read More
Uncommon One Time Only Scheduled Task At 00:00

Dec 1, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage

Dec 1, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
Potential Persistence Via Netsh Helper DLL

Nov 28, 2023 · attack.privilege_escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Wusa.EXE Executed By Parent Process Located In Suspicious Location

Nov 28, 2023 · attack.execution ·
Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.

Read More
Wusa.EXE Extracting Cab Files From Suspicious Paths

Nov 28, 2023 · attack.execution ·
Share on:

Detects usage of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument from suspicious paths

Read More
Chromium Browser Instance Executed With Custom Extension

Nov 28, 2023 · attack.persistence attack.t1176 ·
Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Read More
Suspicious Chromium Browser Instance Executed With Custom Extension

Nov 28, 2023 · attack.persistence attack.t1176 ·
Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Read More
PUA - AdFind Suspicious Execution

Nov 27, 2023 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·
Share on:

Detects AdFind execution with common flags seen used during attacks

Read More
Scheduled Task Creation

Nov 27, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks in user session

Read More
Rundll32 Execution Without DLL File

Nov 20, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects the execution of rundll32 with a command line that doesn't contain a .dll file

Read More
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Nov 20, 2023 · attack.credential_access attack.discovery attack.t1552 ·
Share on:

Detects execution of different log query utilities to search and dump the content of specific event logs or look for specific event IDs.

Read More
Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Nov 15, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Read More
Findstr GPP Passwords

Nov 15, 2023 · attack.credential_access attack.t1552.006 ·
Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Read More
Findstr Launching .lnk File

Nov 15, 2023 · attack.defense_evasion attack.t1036 attack.t1202 attack.t1027.003 ·
Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Read More
Insensitive Subfolder Search Via Findstr.EXE

Nov 15, 2023 · attack.defense_evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Read More
LSASS Process Reconnaissance Via Findstr.EXE

Nov 15, 2023 · attack.credential_access attack.t1552.006 ·
Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Read More
Permission Misconfiguration Reconnaissance Via Findstr.EXE

Nov 15, 2023 · attack.credential_access attack.t1552.006 ·
Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This is seen being used in combination with "icacls" to look for misconfigured files or folders permissions

Read More
Proxy Execution Via Wuauclt.EXE

Nov 15, 2023 · attack.defense_evasion attack.t1218 attack.execution ·
Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Read More
Recon Command Output Piped To Findstr.EXE

Nov 15, 2023 · attack.discovery attack.t1057 ·
Share on:

Detects the excution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this to extract specific information they require in their chain.

Read More
Remote File Download Via Findstr.EXE

Nov 15, 2023 · attack.defense_evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Read More
Renamed Office Binary Execution

Nov 15, 2023 · attack.defense_evasion ·
Share on:

Detects the execution of a renamed office binary

Read More
Security Tools Keyword Lookup Via Findstr.EXE

Nov 15, 2023 · attack.discovery attack.t1518.001 ·
Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Read More
Suspicious Shim Database Installation via Sdbinst.EXE

Nov 15, 2023 · attack.persistence attack.privilege_escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Suspicious Windows Update Agent Empty Cmdline

Nov 15, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

Read More
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

Nov 15, 2023 · attack.discovery attack.t1518.001 ·
Share on:

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

Read More
Uncommon Userinit Child Process

Nov 15, 2023 · attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Arbitrary File Download Via IMEWDBLD.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSEDGE_PROXY.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSOHTMED.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Read More
Arbitrary File Download Via MSPUB.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Read More
Arbitrary File Download Via PresentationHost.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Read More
Arbitrary File Download Via Squirrel.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
File Download And Execution Via IEExec.EXE

Nov 14, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects execution of the IEExec utility to download and execute files

Read More
File Download From Browser Process Via Inline URL

Nov 14, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

Read More
File Download Using ProtocolHandler.exe

Nov 14, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

Read More
File Download Via InstallUtil.EXE

Nov 14, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE"

Read More
File Download Via Windows Defender MpCmpRun.EXE

Nov 14, 2023 · attack.defense_evasion attack.t1218 attack.command_and_control attack.t1105 ·
Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

Read More
Msxsl.EXE Execution

Nov 14, 2023 · attack.defense_evasion attack.t1220 ·
Share on:

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

Read More
Potential File Download Via MS-AppInstaller Protocol Handler

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Read More
Potentially Suspicious Electron Application CommandLine

Nov 14, 2023 · attack.execution ·
Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Read More
Process Proxy Execution Via Squirrel.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Remote XSL Execution Via Msxsl.EXE

Nov 14, 2023 · attack.defense_evasion attack.t1220 ·
Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Read More
Suspicious Calculator Usage

Nov 14, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

Read More
Uncommon Child Process Of Appvlp.EXE

Nov 14, 2023 · attack.t1218 attack.defense_evasion attack.execution ·
Share on:

Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file.

Read More
XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

Read More
XSL Script Execution Via WMIC.EXE

Nov 14, 2023 · attack.defense_evasion attack.t1220 ·
Share on:

Detects the execution of WMIC with the "format" flag to potentially load XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Read More
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Nov 14, 2023 · attack.t1021.003 attack.lateral_movement ·
Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Read More
Suspicious Process By Web Server Process

Nov 11, 2023 · attack.persistence attack.t1505.003 attack.t1190 ·
Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More
Portable Gpg.EXE Execution

Nov 10, 2023 · attack.impact attack.t1486 ·
Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Read More
Suspicious Whoami.EXE Execution

Nov 10, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of "whoami.exe" with the "/all" flag or with redirection options to export the results to a file for later use.

Read More
Suspicious WmiPrvSE Child Process

Nov 10, 2023 · attack.execution attack.defense_evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Read More
Chopper Webshell Process Pattern

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More
Shell Process Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
Suspicious Processes Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
Webshell Detection With Command Line Keywords

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More
Webshell Hacking Activity Patterns

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More
Webshell Tool Reconnaissance Activity

Nov 10, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

Read More
Execute Code with Pester.bat

Nov 9, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Csc.EXE Execution Form Potentially Suspicious Parent

Nov 6, 2023 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense_evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
Dynamic .NET Compilation Via Csc.EXE

Nov 6, 2023 · attack.defense_evasion attack.t1027.004 ·
Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Read More
Obfuscated IP Download Activity

Nov 6, 2023 · attack.discovery ·
Share on:

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Read More
Obfuscated IP Via CLI

Nov 6, 2023 · attack.discovery ·
Share on:

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

Read More
HackTool - CrackMapExec Execution Patterns

Nov 6, 2023 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
Port Forwarding Activity Via SSH.EXE

Nov 6, 2023 · attack.command_and_control attack.lateral_movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Potentially Suspicious Cabinet File Expansion

Nov 6, 2023 · attack.execution attack.t1218 ·
Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Read More
Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 6, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Read More
Weak or Abused Passwords In CLI

Nov 6, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
AgentExecutor PowerShell Execution

Nov 2, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
Browser Started with Remote Debugging

Nov 2, 2023 · attack.credential_access attack.t1185 ·
Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Read More
Deletion of Volume Shadow Copies via WMI with PowerShell

Nov 2, 2023 · attack.impact attack.t1490 ·
Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Read More
ImagingDevices Unusual Parent/Child Processes

Nov 2, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Read More
Lolbin Defaultpack.exe Use As Proxy

Nov 2, 2023 · attack.t1218 attack.defense_evasion attack.execution ·
Share on:

Detect usage of the "defaultpack.exe" binary as a proxy to launch other programs

Read More
Lolbin Runexehelper Use As Proxy

Nov 2, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Read More
Lolbin Unregmp2.exe Use As Proxy

Nov 2, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

Read More
Microsoft IIS Connection Strings Decryption

Nov 2, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Read More
Net WebClient Casing Anomalies

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Read More
Perl Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Read More
Php Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Read More
Potential COM Objects Download Cradles Usage - Process Creation

Nov 2, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Read More
Potential Data Stealing Via Chromium Headless Debugging

Nov 2, 2023 · attack.credential_access attack.t1185 ·
Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Read More
Potential RDP Session Hijacking Activity

Nov 2, 2023 · attack.execution ·
Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Read More
Potential Suspicious Activity Using SeCEdit

Nov 2, 2023 · attack.discovery attack.persistence attack.defense_evasion attack.credential_access attack.privilege_escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential Suspicious Windows Feature Enabled - ProcCreation

Nov 2, 2023 · attack.defense_evasion ·
Share on:

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Powershell Inline Execution From A File

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects inline execution of PowerShell code from a file

Read More
Powershell Token Obfuscation - Process Creation

Nov 2, 2023 · attack.defense_evasion attack.t1027.009 ·
Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Read More
PowerShell Web Download

Nov 2, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects suspicious ways to download files or content using PowerShell

Read More
Privilege Escalation via Named Pipe Impersonation

Nov 2, 2023 · attack.lateral_movement attack.t1021 ·
Share on:

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Read More
Ruby Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Read More
Suspicious AgentExecutor PowerShell Execution

Nov 2, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
Suspicious Execution of Powershell with Base64

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Commandline to launch powershell with a base64 payload

Read More
Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Nov 2, 2023 · attack.command_and_control attack.t1132.001 ·
Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Read More
Suspicious PowerShell Encoded Command Patterns

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Read More
Suspicious PowerShell Invocations - Specific - ProcessCreation

Nov 2, 2023 · attack.defense_evasion ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious Usage Of ShellExec_RunDLL

Nov 2, 2023 · attack.defense_evasion ·
Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Read More
Suspicious X509Enrollment - Process Creation

Nov 2, 2023 · attack.defense_evasion attack.t1553.004 ·
Share on:

Detect use of X509Enrollment

Read More
Use of Pcalua For Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Read More
Assembly Loading Via CL_LoadAssembly.ps1

Oct 28, 2023 · attack.defense_evasion attack.t1216 ·
Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Read More
Delete All Scheduled Tasks

Oct 28, 2023 · attack.impact attack.t1489 ·
Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Read More
Diskshadow Script Mode - Execution From Potential Suspicious Location

Oct 28, 2023 · attack.execution attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Read More
Kernel Memory Dump Via LiveKD

Oct 28, 2023 · attack.defense_evasion ·
Share on:

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Read More
Password Protected Compressed File Extraction Via 7Zip

Oct 28, 2023 · attack.collection attack.t1560.001 ·
Share on:

Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.

Read More
Potential Amazon SSM Agent Hijacking

Oct 28, 2023 · attack.command_and_control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Oct 28, 2023 · attack.defense_evasion attack.t1564.004 ·
Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Read More
Potential LethalHTA Technique Execution

Oct 28, 2023 · attack.defense_evasion attack.t1218.005 ·
Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Read More
Potential Process Execution Proxy Via CL_Invocation.ps1

Oct 28, 2023 · attack.defense_evasion attack.t1216 ·
Share on:

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Read More
Potential Suspicious Mofcomp Execution

Oct 28, 2023 · attack.execution attack.t1218 ·
Share on:

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

Read More
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Oct 28, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf) by Wscript/Cscript

Read More
Potentially Suspicious Child Process Of VsCode

Oct 28, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Read More
Renamed Visual Studio Code Tunnel Execution

Oct 28, 2023 · attack.command_and_control attack.t1071.001 ·
Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Visual Studio Code Tunnel Execution

Oct 28, 2023 · attack.command_and_control attack.t1071.001 ·
Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Visual Studio Code Tunnel Service Installation

Oct 28, 2023 · attack.command_and_control attack.t1071.001 ·
Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Read More
Visual Studio Code Tunnel Shell Execution

Oct 28, 2023 · attack.command_and_control attack.t1071.001 ·
Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

Read More
Potential SPN Enumeration Via Setspn.EXE

Oct 23, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

Detects service principal name (SPN) enumeration used for Kerberoasting

Read More
Arbitrary File Download Via GfxDownloadWrapper.EXE

Oct 23, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Read More
File Download From IP Based URL Via CertOC.EXE

Oct 23, 2023 · attack.command_and_control attack.execution attack.t1105 ·
Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Read More
File Download From IP URL Via Curl.EXE

Oct 23, 2023 · attack.execution ·
Share on:

Detects file downloads directly from IP address URL using curl.exe

Read More
File Download via CertOC.EXE

Oct 23, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects when a user downloads a file by using CertOC.exe

Read More
Potential Privilege Escalation To LOCAL SYSTEM

Oct 23, 2023 · attack.resource_development attack.t1587.001 ·
Share on:

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Read More
Potentially Suspicious Office Document Executed From Trusted Location

Oct 23, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Read More
Remote File Download Via Desktopimgdownldr Utility

Oct 23, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Read More
Suspicious File Download From IP Via Curl.EXE

Oct 23, 2023 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Read More
Suspicious File Downloaded From Direct IP Via Certutil.EXE

Oct 23, 2023 · attack.defense_evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Read More
System File Execution Location Anomaly

Oct 18, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects a Windows program executable started from a suspicious folder

Read More
7Zip Compressing Dump Files

Oct 18, 2023 · attack.collection attack.t1560.001 ·
Share on:

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Oct 18, 2023 · attack.privilege_escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
Add User to Local Administrators Group

Oct 18, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects suspicious command line that adds an account to the local administrators/administrateurs group

Read More
Add Windows Capability Via PowerShell Cmdlet

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
Always Install Elevated MSI Spawned Cmd And Powershell

Oct 18, 2023 · attack.privilege_escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read More
Boot Configuration Tampering Via Bcdedit.EXE

Oct 18, 2023 · attack.impact attack.t1490 ·
Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Read More
Capture Credentials with Rpcping.exe

Oct 18, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Read More
CobaltStrike Load by Rundll32

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Read More
Compress Data and Lock With Password for Exfiltration With 7-ZIP

Oct 18, 2023 · attack.collection attack.t1560.001 ·
Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Read More
Computer Discovery And Export Via Get-ADComputer Cmdlet

Oct 18, 2023 · attack.discovery attack.t1033 ·
Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Read More
ConvertTo-SecureString Cmdlet Usage Via CommandLine

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Read More
Copy from Admin Share

Oct 18, 2023 · attack.lateral_movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·
Share on:

Detects a suspicious copy command to or from an Admin share or remote

Read More
Cscript/Wscript Uncommon Script Extension Execution

Oct 18, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Read More
Detected Windows Software Discovery

Oct 18, 2023 · attack.discovery attack.t1518 ·
Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Read More
Disable of ETW Trace

Oct 18, 2023 · attack.defense_evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects a command that clears or disables any ETW trace log which could indicate a logging evasion.

Read More
Disable Windows Defender AV Security Monitoring

Oct 18, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Read More
Dism Remove Online Package

Oct 18, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
DriverQuery.EXE Execution

Oct 18, 2023 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Read More
DumpMinitool Execution

Oct 18, 2023 · attack.defense_evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Read More
Elevated System Shell Spawned

Oct 18, 2023 · attack.privilege_escalation attack.defense_evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges.

Read More
Enumeration for Credentials in Registry

Oct 18, 2023 · attack.credential_access attack.t1552.002 ·
Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Read More
Exchange PowerShell Snap-Ins Usage

Oct 18, 2023 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·
Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Read More
Execution Of Non-Existing File

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Read More
Explorer Process Tree Break

Oct 18, 2023 · attack.defense_evasion attack.t1036 ·
Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Read More
Exports Registry Key To a File

Oct 18, 2023 · attack.exfiltration attack.t1012 ·
Share on:

Detects the export of the target Registry key to a file.

Read More
File Decryption Using Gpg4win

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of Gpg4win to decrypt files

Read More
File Encryption Using Gpg4win

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt files

Read More
File Encryption/Decryption Via Gpg4win From Suspicious Locations

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Read More
HackTool - Bloodhound/Sharphound Execution

Oct 18, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

Read More
HackTool - CoercedPotato Execution

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
HackTool - CrackMapExec PowerShell Obfuscation

Oct 18, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027.005 ·
Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Read More
HackTool - Mimikatz Execution

Oct 18, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection well-known mimikatz command line arguments

Read More
HackTool - PCHunter Execution

Oct 18, 2023 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·
Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More
HackTool - PPID Spoofing SelectMyParent Tool Execution

Oct 18, 2023 · attack.defense_evasion attack.t1134.004 ·
Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Read More
HackTool - Rubeus Execution

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More
HackTool - SharpEvtMute Execution

Oct 18, 2023 · attack.defense_evasion attack.t1562.002 ·
Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - SharpImpersonation Execution

Oct 18, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - SharpUp PrivEsc Tool Execution

Oct 18, 2023 · attack.privilege_escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
HackTool - SharpView Execution

Oct 18, 2023 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
HackTool - Stracciatella Execution

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1059 attack.t1562.001 ·
Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Read More
HackTool - UACMe Akagi Execution

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·
Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Read More
HackTool - Windows Credential Editor (WCE) Execution

Oct 18, 2023 · attack.credential_access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE)

Read More
HackTool - XORDump Execution

Oct 18, 2023 · attack.defense_evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious use of XORDump process memory dumping utility

Read More
Imports Registry Key From a File

Oct 18, 2023 · attack.t1112 attack.defense_evasion ·
Share on:

Detects the import of the specified file to the registry with regedit.exe.

Read More
Imports Registry Key From an ADS

Oct 18, 2023 · attack.t1112 attack.defense_evasion ·
Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Read More
Indirect Command Execution From Script File Via Bash.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash

Read More
Indirect Inline Command Execution Via Bash.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash

Read More
Invoke-Obfuscation CLIP+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation STDIN+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
LOL-Binary Copied From System Directory

Oct 18, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

Read More
LOLBIN Execution From Abnormal Drive

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

Read More
LSASS Dump Keyword In CommandLine

Oct 18, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Read More
Malicious Base64 Encoded PowerShell Keywords in Command Lines

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Read More
MMC Spawning Windows Shell

Oct 18, 2023 · attack.lateral_movement attack.t1021.003 ·
Share on:

Detects a Windows command line executable started from MMC

Read More
Net.exe Execution

Oct 18, 2023 · attack.discovery attack.t1007 attack.t1049 attack.t1018 attack.t1135 attack.t1201 attack.t1069.001 attack.t1069.002 attack.t1087.001 attack.t1087.002 attack.lateral_movement attack.t1021.002 attack.s0039 ·
Share on:

Detects execution of Net.exe, whether suspicious or benign.

Read More
New Port Forwarding Rule Added Via Netsh.EXE

Oct 18, 2023 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·
Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Read More
New User Created Via Net.EXE

Oct 18, 2023 · attack.persistence attack.t1136.001 ·
Share on:

Identifies the creation of local users via the net.exe command.

Read More
New User Created Via Net.EXE With Never Expire Option

Oct 18, 2023 · attack.persistence attack.t1136.001 ·
Share on:

Detects creation of local users via the net.exe command with the option "never expire"

Read More
Non Interactive PowerShell Process Spawned

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Read More
Password Provided In Command Line Of Net.EXE

Oct 18, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
Permission Check Via Accesschk.EXE

Oct 18, 2023 · attack.discovery attack.t1069.001 ·
Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Read More
Potential Arbitrary File Download Using Office Application

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detects potential arbitrary file download using a Microsoft Office application

Read More
Potential Browser Data Stealing

Oct 18, 2023 · attack.credential_access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Potential CommandLine Path Traversal Via Cmd.EXE

Oct 18, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Read More
Potential Data Exfiltration Activity Via CommandLine Tools

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Read More
Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Oct 18, 2023 · attack.defense_evasion attack.t1036.003 car.2013-05-009 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Potential Encoded PowerShell Patterns In CommandLine

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Read More
Potential Memory Dumping Activity Via LiveKD

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects execution of LiveKD based on PE metadata or image name

Read More
Potential Persistence Attempt Via Existing Service Tampering

Oct 18, 2023 · attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential PowerShell Command Line Obfuscation

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1027 attack.t1059.001 ·
Share on:

Detects the PowerShell command lines with special characters

Read More
Potential PowerShell Execution Via DLL

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll

Read More
Potential PowerShell Obfuscation Via Reversed Commands

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Read More
Potential Powershell ReverseShell Connection

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Read More
Potential Provlaunch.EXE Binary Proxy Execution Abuse

Oct 18, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Read More
Potential Recon Activity Using DriverQuery.EXE

Oct 18, 2023 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

Read More
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Oct 18, 2023 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Potential Register_App.Vbs LOLScript Abuse

Oct 18, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.

Read More
Potential SquiblyTwo Technique Execution

Oct 18, 2023 · attack.defense_evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Oct 18, 2023 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Read More
Potentially Suspicious Child Process Of WinRAR.EXE

Oct 18, 2023 · attack.execution attack.t1203 ·
Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Read More
Potentially Suspicious GoogleUpdate Child Process

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects potentially suspicious child processes of "GoogleUpdate.exe"

Read More
Potentially Suspicious Rundll32 Activity

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities

Read More
Potentially Suspicious WebDAV LNK Execution

Oct 18, 2023 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
Potentially Suspicious Windows App Activity

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Read More
PowerShell Base64 Encoded FromBase64String Cmdlet

Oct 18, 2023 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Read More
PowerShell Base64 Encoded IEX Cmdlet

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

Read More
PowerShell Base64 Encoded Invoke Keyword

Oct 18, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Read More
PowerShell Download Pattern

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects a Powershell process that contains download commands in its command line string

Read More
PowerShell Script Change Permission Via Set-Acl

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects PowerShell execution to set the ACL of a file or a folder

Read More
PowerShell Set-Acl On Windows Folder

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects PowerShell scripts to set the ACL to a file in the Windows folder

Read More
Private Keys Reconnaissance Via CommandLine Tools

Oct 18, 2023 · attack.credential_access attack.t1552.004 ·
Share on:

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Read More
Process Memory Dump Via Comsvcs.DLL

Oct 18, 2023 · attack.defense_evasion attack.credential_access attack.t1036 attack.t1003.001 car.2013-05-009 ·
Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Read More
PUA - AdvancedRun Execution

Oct 18, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - AdvancedRun Suspicious Execution

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1134.002 ·
Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Read More
PUA - Netcat Suspicious Execution

Oct 18, 2023 · attack.command_and_control attack.t1095 ·
Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Read More
PUA - Nmap/Zenmap Execution

Oct 18, 2023 · attack.discovery attack.t1046 ·
Share on:

Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Read More
PUA - NSudo Execution

Oct 18, 2023 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NSudo tool for command execution

Read More
PUA - Potential PE Metadata Tamper Using Rcedit

Oct 18, 2023 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·
Share on:

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Read More
PUA - Process Hacker Execution

Oct 18, 2023 · attack.defense_evasion attack.discovery attack.persistence attack.privilege_escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors regularly abuse it to manipulate system processes.

Read More
PUA - System Informer Execution

Oct 18, 2023 · attack.persistence attack.privilege_escalation attack.discovery attack.defense_evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
PUA- IOX Tunneling Tool Execution

Oct 18, 2023 · attack.command_and_control attack.t1090 ·
Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Read More
Python Inline Command Execution

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Read More
RDP Connection Allowed Via Netsh.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1562.004 ·
Share on:

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

Read More
Recon Information for Export with Command Prompt

Oct 18, 2023 · attack.collection attack.t1119 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
Regasm/Regsvcs Suspicious Execution

Oct 18, 2023 · attack.defense_evasion attack.t1218.009 ·
Share on:

Detects suspicious execution of Regasm/Regsvcs utilities

Read More
Remote Access Tool - RURAT Execution From Unusual Location

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')

Read More
Renamed AdFind Execution

Oct 18, 2023 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·
Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Read More
Renamed AutoHotkey.EXE Execution

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects execution of a renamed autohotkey.exe binary based on PE metadata fields

Read More
Renamed AutoIt Execution

Oct 18, 2023 · attack.defense_evasion attack.t1027 ·
Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Read More
Renamed CreateDump Utility Execution

Oct 18, 2023 · attack.defense_evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Read More
Renamed PAExec Execution

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Read More
Script Interpreter Execution From Suspicious Folder

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Read More
Shadow Copies Creation Using Operating Systems Utilities

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Read More
Share And Session Enumeration Using Net.EXE

Oct 18, 2023 · attack.discovery attack.t1018 ·
Share on:

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Read More
Start Windows Service Via Net.EXE

Oct 18, 2023 · attack.execution attack.t1569.002 ·
Share on:

Detects the usage of the "net.exe" command to start a service using the "start" flag

Read More
Stop Windows Service Via Net.EXE

Oct 18, 2023 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service

Read More
Stop Windows Service Via PowerShell Stop-Service

Oct 18, 2023 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service

Read More
Stop Windows Service Via Sc.EXE

Oct 18, 2023 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service

Read More
Suspect Svchost Activity

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·
Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Read More
Suspicious Add User to Remote Desktop Users Group

Oct 18, 2023 · attack.persistence attack.lateral_movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects suspicious command line in which a user gets added to the local Remote Desktop Users group

Read More
Suspicious Advpack Call Via Rundll32.EXE

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function

Read More
Suspicious Child Process of AspNetCompiler

Oct 18, 2023 · attack.defense_evasion attack.t1127 ·
Share on:

Detects potentially suspicious child processes of "aspnet_compiler.exe".

Read More
Suspicious Child Process Of BgInfo.EXE

Oct 18, 2023 · attack.execution attack.t1059.005 attack.defense_evasion attack.t1218 attack.t1202 ·
Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Suspicious Copy From or To System Directory

Oct 18, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

Read More
Suspicious Csi.exe Usage

Oct 18, 2023 · attack.execution attack.t1072 attack.defense_evasion attack.t1218 ·
Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Read More
Suspicious Download from Office Domain

Oct 18, 2023 · attack.command_and_control attack.t1105 attack.t1608 ·
Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Read More
Suspicious DumpMinitool Execution

Oct 18, 2023 · attack.defense_evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious ways to use the "DumpMinitool.exe" binary

Read More
Suspicious Electron Application Child Processes

Oct 18, 2023 · attack.execution ·
Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

Read More
Suspicious Encoded PowerShell Command Line

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Read More
Suspicious Execution From GUID Like Folder Names

Oct 18, 2023 · attack.defense_evasion attack.t1027 ·
Share on:

Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks

Read More
Suspicious Execution Of PDQDeployRunner

Oct 18, 2023 · attack.execution ·
Share on:

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Read More
Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Oct 18, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 ·
Share on:

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE

Read More
Suspicious Invoke-WebRequest Execution

Oct 18, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Read More
Suspicious Invoke-WebRequest Execution With DirectIP

Oct 18, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Read More
Suspicious Manipulation Of Default Accounts Via Net.EXE

Oct 18, 2023 · attack.collection attack.t1560.001 ·
Share on:

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Read More
Suspicious Microsoft Office Child Process

Oct 18, 2023 · attack.defense_evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Suspicious Microsoft OneNote Child Process

Oct 18, 2023 · attack.t1566 attack.t1566.001 attack.initial_access ·
Share on:

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Read More
Suspicious MSHTA Child Process

Oct 18, 2023 · attack.defense_evasion attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·
Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Read More
Suspicious Mshta.EXE Execution Patterns

Oct 18, 2023 · attack.execution attack.t1106 ·
Share on:

Detects suspicious mshta process execution patterns

Read More
Suspicious MsiExec Embedding Parent

Oct 18, 2023 · attack.t1218.007 attack.defense_evasion ·
Share on:

Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads

Read More
Suspicious Msiexec Execute Arbitrary DLL

Oct 18, 2023 · attack.defense_evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Suspicious Outlook Child Process

Oct 18, 2023 · attack.execution attack.t1204.002 ·
Share on:

Detects a suspicious process spawning from an Outlook process.

Read More
Suspicious Parent Double Extension File Execution

Oct 18, 2023 · attack.defense_evasion attack.t1036.007 ·
Share on:

Detect execution of suspicious double extension files in ParentCommandLine

Read More
Suspicious Powercfg Execution To Change Lock Screen Timeout

Oct 18, 2023 · attack.defense_evasion ·
Share on:

Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout

Read More
Suspicious PowerShell Parent Process

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Read More
Suspicious Process Start Locations

Oct 18, 2023 · attack.defense_evasion attack.t1036 car.2013-05-002 ·
Share on:

Detects suspicious process run from unusual locations

Read More
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1562.004 ·
Share on:

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

Read More
Suspicious Program Names

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Read More
Suspicious Provlaunch.EXE Child Process

Oct 18, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Read More
Suspicious Remote Child Process From Outlook

Oct 18, 2023 · attack.execution attack.t1059 attack.t1202 ·
Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Read More
Suspicious SYSTEM User Process Creation

Oct 18, 2023 · attack.credential_access attack.defense_evasion attack.privilege_escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Oct 18, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Read More
Suspicious WebDav Client Execution Via Rundll32.EXE

Oct 18, 2023 · attack.exfiltration attack.t1048.003 cve.2023.23397 ·
Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Read More
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Read More