process_creation

DLL Sideloading by VMware Xfer Utility

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.t1112 ·

Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Potential DLL Sideloading Via DeviceEnroller.EXE

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Potential Mpclient.DLL Sideloading Via Defender Binaries

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Potentially Suspicious Child Process of KeyScrambler.exe

May 15, 2025 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.001 ·

Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Renamed Vmnat.exe Execution

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Suspicious GUP Usage

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Tasks Folder Evasion

May 15, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1574.001 ·

Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Xwizard.EXE Execution From Non-Default Location

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Direct Autorun Keys Modification

May 12, 2025 · attack.persistence attack.t1547.001 ·

Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Potential Persistence Attempt Via Run Keys Using Reg.EXE

May 12, 2025 · attack.persistence attack.t1547.001 ·

Share on:

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Suspicious Autorun Registry Modified via WMI

May 12, 2025 · attack.execution attack.persistence attack.t1547.001 attack.t1047 ·

Share on:

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

CreateDump Process Dump

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·

Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

DumpMinitool Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·

Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

HackTool - XORDump Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·

Share on:

Detects suspicious use of XORDump process memory dumping utility

Potential SysInternals ProcDump Evasion

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·

Share on:

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Procdump Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·

Share on:

Detects usage of the SysInternals Procdump utility

Renamed CreateDump Utility Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·

Share on:

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Suspicious DumpMinitool Execution

Apr 25, 2025 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 ·

Share on:

Detects suspicious ways to use the "DumpMinitool.exe" binary

Chopper Webshell Process Pattern

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Exports Critical Registry Keys To a File

Apr 25, 2025 · attack.exfiltration attack.discovery attack.t1012 ·

Share on:

Detects the export of a crital Registry key to a file.

Exports Registry Key To a File

Apr 25, 2025 · attack.exfiltration attack.discovery attack.t1012 ·

Share on:

Detects the export of the target Registry key to a file.

HackTool - SharpUp PrivEsc Tool Execution

Apr 25, 2025 · attack.privilege-escalation attack.discovery attack.execution attack.t1615 attack.t1569.002 attack.t1574.005 ·

Share on:

Detects the use of SharpUp, a tool for local privilege escalation

HackTool - winPEAS Execution

Apr 25, 2025 · attack.privilege-escalation attack.discovery attack.t1082 attack.t1087 attack.t1046 ·

Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Webshell Detection With Command Line Keywords

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Webshell Hacking Activity Patterns

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Apr 17, 2025 · attack.t1564.002 ·

Share on:

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Obfuscated PowerShell OneLiner Execution

Apr 17, 2025 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·

Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Apr 17, 2025 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Apr 17, 2025 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Scheduled Task Executing Encoded Payload from Registry

Apr 17, 2025 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Suspicious Eventlog Clearing or Configuration Change Activity

Apr 16, 2025 · attack.defense-evasion attack.t1070.001 attack.t1562.002 car.2016-04-002 ·

Share on:

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

Potential Product Class Reconnaissance Via Wmic.EXE

Apr 16, 2025 · attack.execution attack.t1047 attack.discovery attack.t1082 ·

Share on:

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

Potential Browser Data Stealing

Apr 16, 2025 · attack.credential-access attack.t1555.003 ·

Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Suspicious LNK Command-Line Padding with Whitespace Characters

Apr 16, 2025 · attack.initial-access attack.execution attack.t1204.002 ·

Share on:

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.

File Recovery From Backup Via Wbadmin.EXE

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

LSASS Process Reconnaissance Via Findstr.EXE

Apr 16, 2025 · attack.credential-access attack.t1552.006 ·

Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Potential Suspicious Browser Launch From Document Reader Process

Apr 16, 2025 · attack.execution attack.t1204.002 ·

Share on:

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Potentially Suspicious Usage Of Qemu

Apr 16, 2025 · attack.command-and-control attack.t1090 attack.t1572 ·

Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

Apr 16, 2025 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

Sensitive File Dump Via Wbadmin.EXE

Apr 16, 2025 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Sensitive File Recovery From Backup Via Wbadmin.EXE

Apr 16, 2025 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Windows Recall Feature Enabled Via Reg.EXE

Apr 16, 2025 · attack.collection attack.t1113 ·

Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Potential Adplus.EXE Abuse

Apr 16, 2025 · attack.defense-evasion attack.execution attack.credential-access attack.t1003.001 ·

Share on:

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Potential Binary Impersonating Sysinternals Tools

Apr 16, 2025 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 attack.t1036.005 ·

Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.

Conhost Spawned By Uncommon Parent Process

Apr 7, 2025 · attack.execution attack.t1059 ·

Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Elevated System Shell Spawned From Uncommon Parent Location

Apr 7, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Potential WinAPI Calls Via CommandLine

Apr 7, 2025 · attack.execution attack.t1106 ·

Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Whoami.EXE Execution Anomaly

Apr 7, 2025 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Windows Processes Suspicious Parent Directory

Apr 7, 2025 · attack.defense-evasion attack.t1036.003 attack.t1036.005 ·

Share on:

Detect suspicious parent processes of well-known Windows processes

Notepad Password Files Discovery

Mar 4, 2025 · attack.discovery attack.t1083 ·

Share on:

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

PUA - SoftPerfect Netscan Execution

Mar 4, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Malicious PowerShell Commandlets - ProcessCreation

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Remote Access Tool - AnyDesk Execution

Mar 4, 2025 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - Anydesk Execution From Suspicious Folder

Mar 4, 2025 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Potential Obfuscated Ordinal Call Via Rundll32

Feb 25, 2025 · attack.defense-evasion attack.t1027.010 ·

Share on:

Detects execution of "rundll32" with potential obfuscated ordinal calls

Process Memory Dump Via Comsvcs.DLL

Feb 25, 2025 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 car.2013-05-009 ·

Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Python Inline Command Execution

Feb 22, 2025 · attack.execution attack.t1059 ·

Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

AADInternals PowerShell Cmdlets Execution - ProccessCreation

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

PUA - NimScan Execution

Feb 17, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.

Schtasks Creation Or Modification With SYSTEM Privileges

Feb 17, 2025 · attack.execution attack.persistence attack.t1053.005 ·

Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Kernel Memory Dump Via LiveKD

Feb 3, 2025 · attack.defense-evasion ·

Share on:

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Loaded Module Enumeration Via Tasklist.EXE

Feb 3, 2025 · attack.t1003 ·

Share on:

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Potentially Suspicious CMD Shell Output Redirect

Feb 3, 2025 · attack.defense-evasion attack.t1218 ·

Share on:

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Remote Access Tool - Team Viewer Session Started On Windows Host

Feb 3, 2025 · attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Renamed NirCmd.EXE Execution

Feb 3, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Rundll32 Execution With Uncommon DLL Extension

Feb 3, 2025 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects the execution of rundll32 with a command line that doesn't contain a common extension

Suspicious Command Patterns In Scheduled Task Creation

Feb 3, 2025 · attack.execution attack.t1053.005 ·

Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Suspicious Response File Execution Via Odbcconf.EXE

Feb 3, 2025 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

HackTool - Dumpert Process Dumper Execution

Jan 22, 2025 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Jan 22, 2025 · attack.defense-evasion attack.t1055.001 ·

Share on:

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Renamed ZOHO Dctask64 Execution

Jan 22, 2025 · attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·

Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Console CodePage Lookup Via CHCP

Jan 6, 2025 · attack.discovery attack.t1614.001 ·

Share on:

Detects use of chcp to look up the system locale value as part of host discovery

Diskshadow Script Mode - Uncommon Script Extension Execution

Jan 6, 2025 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Enumerate All Information With Whoami.EXE

Jan 6, 2025 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/all" flag

File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

Insensitive Subfolder Search Via Findstr.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Interesting Service Enumeration Via Sc.EXE

Jan 6, 2025 · attack.t1003 ·

Share on:

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

Port Forwarding Activity Via SSH.EXE

Jan 6, 2025 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

Potentially Suspicious Ping/Copy Command Combination

Jan 6, 2025 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Rebuild Performance Counter Values Via Lodctr.EXE

Jan 6, 2025 · attack.execution ·

Share on:

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Jan 6, 2025 · attack.execution attack.initial-access ·

Share on:

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Remote Access Tool - ScreenConnect Remote Command Execution

Jan 6, 2025 · attack.execution attack.t1059.003 ·

Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Remote Access Tool - ScreenConnect Server Web Shell Execution

Jan 6, 2025 · attack.initial-access attack.t1190 ·

Share on:

Detects potential web shell execution from the ScreenConnect server process.

Remote Access Tool - Simple Help Execution

Jan 6, 2025 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote File Download Via Findstr.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Response File Execution Via Odbcconf.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Suspicious File Download From IP Via Wget.EXE - Paths

Jan 6, 2025 · attack.execution ·

Share on:

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Suspicious File Encoded To Base64 Via Certutil.EXE

Jan 6, 2025 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

Suspicious Invoke-WebRequest Execution

Jan 6, 2025 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Suspicious Windows Service Tampering

Dec 27, 2024 · attack.defense-evasion attack.t1489 attack.t1562.001 ·

Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

QuickAssist Execution

Dec 19, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Always Install Elevated Windows Installer

Dec 1, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Permission Check Via Accesschk.EXE

Dec 1, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Potential Privilege Escalation via Service Permissions Weakness

Dec 1, 2024 · attack.privilege-escalation attack.t1574.011 ·

Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·

Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Suspicious Child Process Created as System

Dec 1, 2024 · attack.privilege-escalation attack.t1134.002 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Suspicious Process By Web Server Process

Dec 1, 2024 · attack.persistence attack.t1505.003 attack.t1190 ·

Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·

Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·

Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

HackTool - SharpMove Tool Execution

Dec 1, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

HackTool - SOAPHound Execution

Dec 1, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Potential Dropper Script Execution Via WScript/CScript

Dec 1, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects wscript/cscript executions of scripts located in user directories

PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

System Disk And Volume Reconnaissance Via Wmic.EXE

Dec 1, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·

Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

HackTool - CreateMiniDump Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution GMER tool based on image and hash fields.

HackTool - HandleKatz LSASS Dumper Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·

Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·

Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·

Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·

Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

HackTool - Windows Credential Editor (WCE) Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·

Share on:

Detects the use of Windows Credential Editor (WCE)

Hacktool Execution - Imphash

Nov 25, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

PUA - Nimgrab Execution

Nov 25, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Renamed AdFind Execution

Nov 25, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Compressed File Creation Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Compressed File Extraction Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Cscript/Wscript Potentially Suspicious Child Process

Nov 1, 2024 · attack.execution ·

Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Firewall Configuration Discovery Via Netsh.EXE

Nov 1, 2024 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

Potentially Suspicious Command Targeting Teams Sensitive Files

Nov 1, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of a renamed "cloudflared" binary.

Suspicious Greedy Compression Using Rar.EXE

Nov 1, 2024 · attack.execution attack.t1059 ·

Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Uncommon System Information Discovery Via Wmic.EXE

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Suspicious File Download From File Sharing Domain Via Curl.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Suspicious File Download From File Sharing Domain Via Wget.EXE

Oct 25, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

HackTool - Certipy Execution

Oct 8, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Share on:

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Potentially Suspicious JWT Token Search Via CLI

Oct 6, 2024 · attack.credential-access attack.t1528 ·

Share on:

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new potentially suspicious download sources

Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·

Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·

Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Permission Misconfiguration Reconnaissance Via Findstr.EXE

Oct 1, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Portable Gpg.EXE Execution

Oct 1, 2024 · attack.impact attack.t1486 ·

Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Oct 1, 2024 · attack.t1021.003 attack.lateral-movement ·

Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Potentially Suspicious Electron Application CommandLine

Oct 1, 2024 · attack.execution ·

Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

PowerShell Execution With Potential Decryption Capabilities

Oct 1, 2024 · attack.execution ·

Share on:

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Security Tools Keyword Lookup Via Findstr.EXE

Oct 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Suspicious Chromium Browser Instance Executed With Custom Extension

Oct 1, 2024 · attack.persistence attack.t1176 ·

Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Unusual Parent Process For Cmd.EXE

Oct 1, 2024 · attack.execution attack.t1059 ·

Share on:

Detects suspicious parent process for cmd.exe

Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·

Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Whoami.EXE Execution With Output Option

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·

Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

PowerShell Web Access Feature Enabled Via DISM

Sep 3, 2024 · attack.persistence attack.t1548.002 ·

Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·

Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

File Download From IP URL Via Curl.EXE

Sep 2, 2024 · attack.execution ·

Share on:

Detects file downloads directly from IP address URL using curl.exe

Obfuscated IP Via CLI

Sep 2, 2024 · attack.discovery ·

Share on:

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Potentially Suspicious Office Document Executed From Trusted Location

Sep 2, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Python Function Execution Security Warning Disabled In Excel

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Aug 29, 2024 · attack.discovery attack.t1135 ·

Share on:

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

HackTool - SharpWSUS/WSUSpendu Execution

Aug 29, 2024 · attack.execution attack.lateral-movement attack.t1210 ·

Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Potential AMSI Bypass Via .NET Reflection

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

RestrictedAdminMode Registry Value Tampering - ProcCreation

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·

Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Aug 29, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

Aug 29, 2024 · attack.execution ·

Share on:

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

COM Object Execution via Xwizard.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

New Capture Session Launched Via DXCap.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Potential DLL Injection Via AccCheckConsole

Aug 29, 2024 · attack.execution detection.threat-hunting ·

Share on:

Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Aug 29, 2024 · attack.credential-access attack.discovery attack.t1552 ·

Share on:

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Process Memory Dump via RdrLeakDiag.EXE

Aug 29, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Program Executed Using Proxy/Local Command Via SSH.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Wusa.EXE Executed By Parent Process Located In Suspicious Location

Aug 29, 2024 · attack.execution ·

Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Disable Important Scheduled Task

Aug 26, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 23, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 23, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Data Export From MSSQL Table Via BCP.EXE

Aug 20, 2024 · attack.execution attack.t1048 ·

Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Potentially Suspicious Rundll32.EXE Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·

Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 16, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

HackTool - LaZagne Execution

Aug 16, 2024 · attack.credential-access ·

Share on:

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

7Zip Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Abused Debug Privilege by Arbitrary Parent Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·

Share on:

Detection of unusual child processes by different system processes

Abusing Print Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Attackers can use print.exe for remote file copy

Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·

Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database.

Active Directory Structure Export Via Csvde.EXE

Aug 12, 2024 · attack.exfiltration attack.discovery attack.t1087.002 ·

Share on:

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Active Directory Structure Export Via Ldifde.EXE

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new additional download sources

Add SafeBoot Keys Via Reg Utility

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Add Windows Capability Via PowerShell Cmdlet

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

AddinUtil.EXE Execution From Uncommon Directory

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

All Backups Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·

Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Always Install Elevated MSI Spawned Cmd And Powershell

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Application Removed Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the removal or uninstallation of an application via "Wmic.EXE".

Application Terminated Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects calls to the "terminate" function via wmic in order to kill an application

Arbitrary Binary Execution Using GUP Utility

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Arbitrary File Download Via ConfigSecurityPolicy.EXE

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Arbitrary Shell Command Execution Via Settingcontent-Ms

Aug 12, 2024 · attack.t1204 attack.t1566.001 attack.execution attack.initial-access ·

Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

AspNetCompiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Audio Capture via PowerShell

Aug 12, 2024 · attack.collection attack.t1123 ·

Share on:

Detects audio capture via PowerShell Cmdlet.

Audio Capture via SoundRecorder

Aug 12, 2024 · attack.collection attack.t1123 ·

Share on:

Detect attacker collecting audio via SoundRecorder application.

Audit Policy Tampering Via Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Audit Policy Tampering Via NT Resource Kit Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Automated Collection Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 attack.credential-access attack.t1552.001 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Base64 Encoded PowerShell Command Detected

Aug 12, 2024 · attack.t1027 attack.defense-evasion attack.t1140 attack.t1059.001 ·

Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Base64 MZ Header In CommandLine

Aug 12, 2024 · attack.execution ·

Share on:

Detects encoded base64 MZ header in the commandline

BitLockerTogo.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

Boot Configuration Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of Chromium based browser in headless mode

Browser Started with Remote Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·

Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·

Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Bypass UAC via Fodhelper.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

C# IL Code Compilation Via Ilasm.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Capture Credentials with Rpcping.exe

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Certificate Exported Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Certificate Exported Via PowerShell

Aug 12, 2024 · attack.credential-access attack.execution attack.t1552.004 attack.t1059.001 ·

Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Change Default File Association To Executable Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·

Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Change Default File Association Via Assoc

Aug 12, 2024 · attack.persistence attack.t1546.001 ·

Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Change PowerShell Policies to an Insecure Level

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Changing Existing Service ImagePath Value Via Reg.EXE

Aug 12, 2024 · attack.persistence attack.t1574.011 ·

Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Chromium Browser Headless Execution To Mockbin Like Site

Aug 12, 2024 · attack.execution ·

Share on:

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Cmd.EXE Missing Space Characters Execution Anomaly

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

CobaltStrike Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Code Execution via Pcwutl.dll

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Compress Data and Lock With Password for Exfiltration With 7-ZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Compress Data and Lock With Password for Exfiltration With WINZIP

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Computer Discovery And Export Via Get-ADComputer Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Computer Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects password change for the computer's domain account or host principal via "ksetup.exe"

Computer System Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1047 ·

Share on:

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

Conhost.exe CommandLine Path Traversal

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·

Share on:

Detects the malicious use of a control panel item

ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

Aug 12, 2024 · attack.credential-access ·

Share on:

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Copy From Or To Admin Share Or Sysvol Folder

Aug 12, 2024 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

Copy From VolumeShadowCopy Via Cmd.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

Copying Sensitive Files with Credential Data

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·

Share on:

Files with well-known filenames (sensitive files with credential data) copying

Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·

Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Cscript/Wscript Uncommon Script Extension Execution

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Curl Web Request With Potential Custom User-Agent

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Data Copied To Clipboard Via Clip.EXE

Aug 12, 2024 · attack.collection attack.t1115 ·

Share on:

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Delete All Scheduled Tasks

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Delete Important Scheduled Task

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Deleted Data Overwritten Via Cipher.EXE

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Deletion of Volume Shadow Copies via WMI with PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.t1543.003 ·

Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Detect Virtualbox Driver Installation OR Starting Of VMs

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 attack.t1564 ·

Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Detected Windows Software Discovery

Aug 12, 2024 · attack.discovery attack.t1518 ·

Share on:

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

DeviceCredentialDeployment Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view

Devtoolslauncher.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

The Devtoolslauncher.exe executes other binary

Directory Removal Via Rmdir

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

DirLister Execution

Aug 12, 2024 · attack.discovery attack.t1083 ·

Share on:

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Disable Windows Defender AV Security Monitoring

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Disable Windows IIS HTTP Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Disabled IE Security Features

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Disabled Volume Snapshots

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects commands that temporarily turn off Volume Snapshots

Discovery of a System Time

Aug 12, 2024 · attack.discovery attack.t1124 ·

Share on:

Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

DLL Execution via Rasautou.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

DLL Execution Via Register-cimprovider.exe

Aug 12, 2024 · attack.defense-evasion attack.t1574 ·

Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

DllUnregisterServer Function Call Via Msiexec.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·

Share on:

Well-known DNS Exfiltration tools execution

Domain Trust Discovery Via Dsquery

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects execution of "dsquery.exe" for domain trust discovery

Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

DriverQuery.EXE Execution

Aug 12, 2024 · attack.discovery ·

Share on:

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Dropping Of Password Filter DLL

Aug 12, 2024 · attack.credential-access attack.t1556.002 ·

Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

DSInternals Suspicious PowerShell Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Dumping of Sensitive Hives Via Reg.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·

Share on:

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Dumping Process via Sqldumper.exe

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects process dump via legitimate sqldumper.exe binary

DumpStack.log Defender Evasion

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the use of the filename DumpStack.log to evade Microsoft Defender

Dynamic .NET Compilation Via Csc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·

Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Email Exifiltration Via Powershell

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects email exfiltration via powershell cmdlets

Enable LM Hash Storage - ProcCreation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Enumeration for 3rd Party Creds From CLI

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·

Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Enumeration for Credentials in Registry

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·

Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Esentutl Gather Credentials

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.003 ·

Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Esentutl Steals Browser Information

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

ETW Logging Tamper In .NET Processes Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Trace Evasion Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·

Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

Exchange PowerShell Snap-Ins Usage

Aug 12, 2024 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·

Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execute Files with Msdeploy.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects file execution using the msdeploy.exe lolbin

Execute From Alternate Data Streams

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Execute MSDT Via Answer File

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Execute Pcwrun.EXE To Leverage Follina

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Execution Of Non-Existing File

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Execution of Powershell Script in Public Folder

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Execution via stordiag.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

Execution via WorkFolders.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects using WorkFolders.exe to execute an arbitrary control.exe

Explorer NOUACCHECK Flag

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·

Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Explorer Process Tree Break

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

File And SubFolder Enumeration Via Dir Command

Aug 12, 2024 · attack.discovery attack.t1217 ·

Share on:

Detects usage of the "dir" command part of Widows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

File Decoded From Base64/Hex Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

File Decryption Using Gpg4win

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of Gpg4win to decrypt files

File Deletion Via Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download and execute files

File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

File Download Using ProtocolHandler.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

File Download Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file

File Download Via Bitsadmin To A Suspicious Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

File Download Via Bitsadmin To An Uncommon Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects when a user downloads a file by using CertOC.exe

File Download Via InstallUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE"

File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

File Encryption Using Gpg4win

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of Gpg4win to encrypt files

File Encryption/Decryption Via Gpg4win From Suspicious Locations

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

File With Suspicious Extension Downloaded Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

Files Added To An Archive Using Rar.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Filter Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·

Share on:

Detect filter driver unloading activity via fltmc.exe

Findstr GPP Passwords

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Findstr Launching .lnk File

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1202 attack.t1027.003 ·

Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Firewall Disabled via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0108 ·

Share on:

Detects netsh commands that turns off the Windows firewall

Firewall Rule Deleted Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Firewall Rule Update Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Aug 12, 2024 · attack.collection attack.t1074.001 ·

Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Forfiles Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

Fsutil Behavior Set SymlinkEvaluation

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Fsutil Drive Enumeration

Aug 12, 2024 · attack.discovery attack.t1120 ·

Share on:

Attackers may leverage fsutil to enumerated connected drives.

Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Gpresult Display Group Policy Information

Aug 12, 2024 · attack.discovery attack.t1615 ·

Share on:

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Gpscript Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Greedy File Deletion Using Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Group Membership Reconnaissance Via Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Gzip Archive Decode Via PowerShell

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·

Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

HackTool - ADCSPwn Execution

Aug 12, 2024 · attack.credential-access attack.t1557.001 ·

Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

HackTool - Certify Execution

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Share on:

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

HackTool - Covenant PowerShell Launcher

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1564.003 ·

Share on:

Detects suspicious command lines used in Covenant luanchers

HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·

Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·

Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

HackTool - CrackMapExec Process Patterns

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects suspicious process patterns found in logs when CrackMapExec is used

HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

HackTool - Empire PowerShell Launch Parameters

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell command line parameters used in Empire

HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects some Empire PowerShell UAC bypass methods

HackTool - F-Secure C3 Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

HackTool - Hashcat Password Cracker Execution

Aug 12, 2024 · attack.credential-access attack.t1110.002 ·

Share on:

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·

Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

HackTool - Hydra Password Bruteforce Execution

Aug 12, 2024 · attack.credential-access attack.t1110 attack.t1110.001 ·

Share on:

Detects command line parameters used by Hydra password guessing hack tool

HackTool - Impacket Tools Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·

Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

HackTool - Inveigh Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

HackTool - Jlaive In-Memory Assembly Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

HackTool - KrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

Detects the use of KrbRelay, a Kerberos relaying tool

HackTool - KrbRelayUp Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

HackTool - Mimikatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection well-known mimikatz command line arguments

HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

HackTool - PowerTool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

HackTool - PurpleSharp Execution

Aug 12, 2024 · attack.t1587 attack.resource-development ·

Share on:

Detects the execution of the PurpleSharp adversary simulation tool

HackTool - Pypykatz Credentials Dumping Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

HackTool - Quarks PwDump Execution

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects usage of the Quarks PwDump tool via commandline arguments

HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

HackTool - RemoteKrbRelay Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

HackTool - Rubeus Execution

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

HackTool - SafetyKatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

HackTool - SecurityXploded Execution

Aug 12, 2024 · attack.credential-access attack.t1555 ·

Share on:

Detects the execution of SecurityXploded Tools

HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects usage of the Sharp Chisel via the commandline arguments

HackTool - SharpDPAPI Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

HackTool - SharPersist Execution

Aug 12, 2024 · attack.persistence attack.t1053 ·

Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

HackTool - SharpEvtMute Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - SharpLDAPmonitor Execution

Aug 12, 2024 · attack.discovery ·

Share on:

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

HackTool - SharpLdapWhoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

HackTool - SILENTTRINITY Stager Execution

Aug 12, 2024 · attack.command-and-control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager use via PE metadata

HackTool - Sliver C2 Implant Activity Pattern

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects process activity patterns as seen being used by Sliver C2 framework implants

HackTool - TruffleSnout Execution

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

HackTool - WinRM Access Via Evil-WinRM

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

HackTool - Wmiexec Default Powershell Command

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement ·

Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Hacktool Execution - PE Metadata

Aug 12, 2024 · attack.credential-access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·

Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Harvesting Of Wifi Credentials Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·

Share on:

Detect the harvesting of wifi credentials using netsh.exe

HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of "hh.exe" to open ".chm" files.

Hidden Powershell in Link File Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects events that appear when a user click on a link file with a powershell command in it

Hiding Files with Attrib.exe

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects usage of attrib.exe to hide files from users.

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Ie4uinit Lolbin Use From Invalid Path

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

IIS Native-Code Module Command Line Installation

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious IIS native-code module installations via command line

ImagingDevices Unusual Parent/Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Import PowerShell Modules From Suspicious Directories - ProcCreation

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects powershell scripts that import modules from suspicious directories

Imports Registry Key From a File

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of the specified file to the registry with regedit.exe.

Imports Registry Key From an ADS

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Indirect Command Execution By Program Compatibility Wizard

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Indirect Command Execution From Script File Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Indirect Inline Command Execution Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

InfDefaultInstall.exe .inf Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Insecure Proxy/DOH Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

Insecure Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "--insecure" flag.

Install New Package Via Winget Local Manifest

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Interactive AT Job

Aug 12, 2024 · attack.privilege-escalation attack.t1053.002 ·

Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Invoke-Obfuscation CLIP+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation Obfuscated IEX Invocation

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Invoke-Obfuscation STDIN+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use MSHTA

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Java Running with Remote Debugging

Aug 12, 2024 · attack.t1203 attack.execution ·

Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

JScript Compiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

Kavremover Dropped Binary LOLBIN Usage

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

Launch-VsDevShell.PS1 Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·

Share on:

Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

Local Accounts Discovery

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1087.001 ·

Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Local File Read Using Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

Local Groups Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Logged-On User Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects password change for the logged-on user's via "ksetup.exe"

LOL-Binary Copied From System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

LOLBAS Data Exfiltration by DataSvcUtil.exe

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

LOLBIN Execution From Abnormal Drive

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

Lolbin Runexehelper Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Lolbin Unregmp2.exe Use As Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

LSA PPL Protection Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.010 ·

Share on:

Detects the usage of the "reg.exe" utility to disable PPL protection on the LSA process

LSASS Dump Keyword In CommandLine

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Malicious Base64 Encoded PowerShell Keywords in Command Lines

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Malicious PE Execution by Microsoft Visual Studio Debugger

Aug 12, 2024 · attack.t1218 attack.defense-evasion ·

Share on:

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

Malicious Windows Script Components File Execution by TAEF Detection

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Microsoft IIS Connection Strings Decryption

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Microsoft IIS Service Account Password Dumped

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

MMC Spawning Windows Shell

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 ·

Share on:

Detects a Windows command line executable started from MMC

MMC20 Lateral Movement

Aug 12, 2024 · attack.execution attack.t1021.003 ·

Share on:

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Modify Group Policy Settings

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Monitoring For Persistence Via BITS

Aug 12, 2024 · attack.defense-evasion attack.t1197 ·

Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·

Share on:

Detects the Installation of a Exchange Transport Agent

MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·

Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Mshtml.DLL RunHTMLApplication Suspicious Usage

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Mstsc.EXE Execution From Uncommon Parent

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Msxsl.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

Net WebClient Casing Anomalies

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Netsh Allow Group Policy on Microsoft Defender Firewall

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Adversaries may modify system firewalls in order to bypass controls limiting network usage

Network Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·

Share on:

Detects a set of suspicious network related commands often used in recon stages

New ActiveScriptEventConsumer Created Via Wmic.EXE

Aug 12, 2024 · attack.persistence attack.t1546.003 ·

Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

New DLL Registered Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

New Firewall Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0246 ·

Share on:

Detects the addition of a new rule to the Windows firewall via netsh

New Generic Credentials Added Via Cmdkey.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.005 ·

Share on:

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

New Kernel Driver Via SC.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

New Network Trace Capture Started Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·

Share on:

Detects the execution of netsh with the "trace" flag in order to start a network capture

New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

New Process Created Via Taskmgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

New Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·

Share on:

Detects new process creation using WMIC via the "process call create" flag

New Remote Desktop Connection Initiated Via Mstsc.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·

Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

New Root Certificate Installed Via CertMgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·

Share on:

Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

New Root Certificate Installed Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·

Share on:

Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

New Service Creation Using PowerShell

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the creation of a new service using powershell.

New Service Creation Using Sc.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects the creation of a new service using the "sc.exe" utility.

New User Created Via Net.EXE

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Identifies the creation of local users via the net.exe command.

New User Created Via Net.EXE With Never Expire Option

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Detects creation of local users via the net.exe command with the option "never expire"

New Virtual Smart Card Created Via TpmVscMgr.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.

Nltest.EXE Execution

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Node Process Executions

Aug 12, 2024 · attack.defense-evasion attack.t1127 attack.t1059.007 ·

Share on:

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Non Interactive PowerShell Process Spawned

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Nslookup PowerShell Download Cradle - ProcessCreation

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

NtdllPipe Like Activity Execution

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

Obfuscated IP Download Activity

Aug 12, 2024 · attack.discovery ·

Share on:

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Odbcconf.EXE Suspicious DLL Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

OpenWith.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

The OpenWith.exe executes other binary

Operator Bloopers Cobalt Strike Commands

Aug 12, 2024 · attack.execution attack.t1059.003 stp.1u ·

Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Operator Bloopers Cobalt Strike Modules

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Outlook EnableUnsafeClientMailRules Setting Enabled

Aug 12, 2024 · attack.execution attack.t1059 attack.t1202 ·

Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

PDQ Deploy Remote Adminstartion Tool Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·

Share on:

Detect use of PDQ Deploy remote admin tool

Perl Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Persistence Via Sticky Key Backdoor

Aug 12, 2024 · attack.t1546.008 attack.privilege-escalation ·

Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Persistence Via TypedPaths - CommandLine

Aug 12, 2024 · attack.persistence ·

Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

Phishing Pattern ISO in Archive

Aug 12, 2024 · attack.initial-access attack.t1566 ·

Share on:

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Php Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Ping Hex IP

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1027 ·

Share on:

Detects a ping command that uses a hex encoded IP address

PktMon.EXE Execution

Aug 12, 2024 · attack.credential-access attack.t1040 ·

Share on:

Detects execution of PktMon, a tool that captures network packets.

Potential Active Directory Enumeration Using AD Module - ProcCreation

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Potential Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential AMSI Bypass Using NULL Bits

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Potential Application Whitelisting Bypass via Dnx.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1027.004 ·

Share on:

Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.

Potential Arbitrary Code Execution Via Node.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Potential Arbitrary Command Execution Using Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

Potential Arbitrary Command Execution Via FTP.EXE

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Potential Arbitrary DLL Load Using Winword

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

Potential Arbitrary File Download Using Office Application

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects potential arbitrary file download using a Microsoft Office application

Potential Arbitrary File Download Via Cmdl32.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.

Potential Binary Proxy Execution Via Cdb.EXE

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1218 attack.t1127 ·

Share on:

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Potential Binary Proxy Execution Via VSDiagnostics.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.

Potential CobaltStrike Process Patterns

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects potential process patterns related to Cobalt Strike beacon activity

Potential COM Objects Download Cradles Usage - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential Command Line Path Traversal Evasion Attempt

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

Potential Commandline Obfuscation Using Escape Characters

Aug 12, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects potential commandline obfuscation using known escape characters

Potential CommandLine Path Traversal Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Potential Configuration And Service Reconnaissance Via Reg.EXE

Aug 12, 2024 · attack.discovery attack.t1012 attack.t1007 ·

Share on:

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

Potential Cookies Session Hijacking

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.

Potential Credential Dumping Attempt Using New NetworkProvider - CLI

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Potential Credential Dumping Via LSASS Process Clone

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.001 ·

Share on:

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Potential Credential Dumping Via WER

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

Potential Crypto Mining Activity

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Potential Data Exfiltration Activity Via CommandLine Tools

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Potential Data Stealing Via Chromium Headless Debugging

Aug 12, 2024 · attack.credential-access attack.t1185 ·

Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Potential Defense Evasion Via Binary Rename

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Potential Discovery Activity Via Dnscmd.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1543.003 ·

Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Potential DLL Injection Or Execution Using Tracker.exe

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·

Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Potential Dosfuscation Activity

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects possible payload obfuscation via the commandline

Potential Download/Upload Activity Using Type Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Potential Encoded PowerShell Patterns In CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Potential Execution of Sysinternals Tools

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·

Share on:

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Potential Fake Instance Of Hxtsr.EXE Executed

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe

Potential File Overwrite Via Sysinternals SDelete

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects the use of SDelete to erase a file not the free space

Potential Homoglyph Attack Using Lookalike Characters

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Potential LethalHTA Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·

Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Potential LSASS Process Dump Via Procdump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.credential-access attack.t1003.001 car.2013-05-009 ·

Share on:

Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable.

Potential Manage-bde.wsf Abuse To Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution

Potential Memory Dumping Activity Via LiveKD

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of LiveKD based on PE metadata or image name

Potential Meterpreter/CobaltStrike Activity

Aug 12, 2024 · attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Potential Mftrace.EXE Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.

Potential MsiExec Masquerading

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects the execution of msiexec.exe from an uncommon directory

Potential MSTSC Shadowing Activity

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 ·

Share on:

Detects RDP session hijacking by using MSTSC shadowing

Potential Network Sniffing Activity Using Network Tools

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·

Share on:

Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Potential NTLM Coercion Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects possible NTLM coercion via certutil using the 'syncwithWU' flag

Potential Password Spraying Attempt Using Dsacls.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects possible password spraying attempts using Dsacls

Potential Persistence Attempt Via Existing Service Tampering

Aug 12, 2024 · attack.persistence attack.t1543.003 attack.t1574.011 ·

Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Potential Persistence Via Logon Scripts - CommandLine

Aug 12, 2024 · attack.persistence attack.t1037.001 ·

Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Potential Persistence Via Microsoft Compatibility Appraiser

Aug 12, 2024 · attack.persistence attack.t1053.005 ·

Share on:

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Potential Persistence Via Netsh Helper DLL

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.007 attack.s0108 ·

Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Potential Persistence Via Powershell Search Order Hijacking - Task

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·

Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Potential PowerShell Command Line Obfuscation

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1027 attack.t1059.001 ·

Share on:

Detects the PowerShell command lines with special characters

Potential PowerShell Downgrade Attack

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Potential PowerShell Execution Policy Tampering - ProcCreation

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

Potential PowerShell Execution Via DLL

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.

Potential PowerShell Obfuscation Via Reversed Commands

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Potential PowerShell Obfuscation Via WCHAR

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·

Share on:

Detects suspicious encoded character syntax often used for defense evasion

Potential Powershell ReverseShell Connection

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Potential Privilege Escalation To LOCAL SYSTEM

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·

Share on:

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 ·

Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Potential Process Execution Proxy Via CL_Invocation.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Potential Process Injection Via Msra.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Potential Product Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Potential Provisioning Registry Key Abuse For Binary Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Potential Provlaunch.EXE Binary Proxy Execution Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Potential PsExec Remote Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·

Share on:

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.persistence attack.t1542.003 ·

Share on:

Detects potential malicious and unauthorized usage of bcdedit.exe

Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Execution of plink to perform data exfiltration and tunneling

Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Potential Recon Activity Using DriverQuery.EXE

Aug 12, 2024 · attack.discovery ·

Share on:

Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

Potential Recon Activity Via Nltest.EXE

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.005 ·

Share on:

Detects usage of cmdkey to look for cached credentials on the system

Potential ReflectDebugger Content Execution Via WerFault.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036 ·

Share on:

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

Potential Register_App.Vbs LOLScript Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.

Potential Regsvr32 Commandline Flag Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

Potential Remote Desktop Tunneling

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·

Share on:

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Potential Renamed Rundll32 Execution

Aug 12, 2024 · attack.execution ·

Share on:

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Potential Rundll32 Execution With DLL Stored In ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

Potential Script Proxy Execution Via CL_Mutexverifiers.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Potential ShellDispatch.DLL Functionality Abuse

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"

Potential Shim Database Persistence via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·

Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Potential Signing Bypass Via Windows Developer Features

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Potential SMB Relay Attack Tool Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·

Share on:

Detects different hacktools used for relay attacks on Windows for privilege escalation

Potential SPN Enumeration Via Setspn.EXE

Aug 12, 2024 · attack.credential-access attack.t1558.003 ·

Share on:

Detects service principal name (SPN) enumeration used for Kerberoasting

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Potential Suspicious Mofcomp Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

Potential Suspicious Registry File Imported Via Reg.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility

Potential Suspicious Windows Feature Enabled - ProcCreation

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Potential Tampering With Security Products Via WMIC

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects uninstallation or termination of security products using the WMIC utility

Potential Unquoted Service Path Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

Potential Windows Defender AV Bypass Via Dump64.EXE Rename

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

Potential Windows Defender Tampering Via Wmic.EXE

Aug 12, 2024 · attack.credential-access attack.t1546.008 ·

Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·

Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Potentially Over Permissive Permissions Granted Using Dsacls.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects usage of Dsacls to grant over permissive permissions

Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Potentially Suspicious Call To Win32_NTEventlogFile Class

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Potentially Suspicious Child Process Of ClickOnce Application

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects potentially suspicious child processes of a ClickOnce deployment application

Potentially Suspicious Child Process Of DiskShadow.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.

Potentially Suspicious Child Process Of Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects potentially suspicious child processes of "regsvr32.exe".

Potentially Suspicious Child Process Of WinRAR.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·

Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Potentially Suspicious DLL Registered Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

Potentially Suspicious Event Viewer Child Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Potentially Suspicious Execution From Parent Process In Public Folder

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1564 attack.t1059 ·

Share on:

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

Potentially Suspicious Execution Of PDQDeployRunner

Aug 12, 2024 · attack.execution ·

Share on:

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·

Share on:

Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location

Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.009 ·

Share on:

Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.

Potentially Suspicious GoogleUpdate Child Process

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects potentially suspicious child processes of "GoogleUpdate.exe"

Potentially Suspicious Regsvr32 HTTP IP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

Potentially Suspicious Regsvr32 HTTP/FTP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.

Potentially Suspicious Rundll32 Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities

Potentially Suspicious WebDAV LNK Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1204 ·

Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Potentially Suspicious Windows App Activity

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

PowerShell Base64 Encoded FromBase64String Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

PowerShell Base64 Encoded IEX Cmdlet

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

PowerShell Base64 Encoded Invoke Keyword

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·

Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Powershell Base64 Encoded MpPreference Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

PowerShell Base64 Encoded Reflective Assembly Load

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 attack.t1620 ·

Share on:

Detects base64 encoded .NET reflective loading of Assembly

PowerShell Base64 Encoded WMI Classes

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·

Share on:

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Powershell Defender Disable Scan Feature

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects requests to disable Microsoft Defender features using PowerShell commands

Powershell Defender Exclusion

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets

PowerShell Download and Execution Cradles

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects PowerShell download and execution cradles.

PowerShell Download Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects a Powershell process that contains download commands in its command line string

PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·

Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Powershell Executed From Headless ConHost Process

Aug 12, 2024 · attack.defense-evasion attack.t1059.001 attack.t1059.003 ·

Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

PowerShell Get-Clipboard Cmdlet Via CLI

Aug 12, 2024 · attack.collection attack.t1115 ·

Share on:

Detects usage of the 'Get-Clipboard' cmdlet via CLI

PowerShell Get-Process LSASS

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·

Share on:

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Powershell Inline Execution From A File

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects inline execution of PowerShell code from a file

PowerShell SAM Copy

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects suspicious PowerShell scripts accessing SAM hives

PowerShell Script Change Permission Via Set-Acl

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects PowerShell execution to set the ACL of a file or a folder

PowerShell Script Run in AppData

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

PowerShell Set-Acl On Windows Folder

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects PowerShell scripts to set the ACL to a file in the Windows folder

Powershell Token Obfuscation - Process Creation

Aug 12, 2024 · attack.defense-evasion attack.t1027.009 ·

Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·

Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Private Keys Reconnaissance Via CommandLine Tools

Aug 12, 2024 · attack.credential-access attack.t1552.004 ·

Share on:

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Privilege Escalation via Named Pipe Impersonation

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·

Share on:

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Process Access via TrolleyExpress Exclusion

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 attack.credential-access attack.t1003.001 ·

Share on:

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Process Creation Using Sysnative Folder

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Process Execution From A Potentially Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a potentially suspicious execution from an uncommon folder.

Process Launched Without Image Name

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.

Process Memory Dump Via Dotnet-Dump

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.

Process Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of "wmic" with the "process" flag, which adversary might use to list processes running on the compromised host or list installed software hotfixes and patches.

Proxy Execution Via Wuauclt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Psexec Execution

Aug 12, 2024 · attack.execution attack.t1569 attack.t1021 ·

Share on:

Detects user accept agreement execution in psexec commandline

PsExec Service Child Process Execution as LOCAL SYSTEM

Aug 12, 2024 · attack.execution ·

Share on:

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

PsExec Service Execution

Aug 12, 2024 · attack.execution ·

Share on:

Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution

PsExec/PAExec Escalation to LOCAL SYSTEM

Aug 12, 2024 · attack.resource-development attack.t1587.001 ·

Share on:

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Detects the use of 3proxy, a tiny free proxy server

PUA - AdFind Suspicious Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·

Share on:

Detects AdFind execution with common flags seen used during attacks

PUA - Adidnsdump Execution

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP

PUA - Advanced IP Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·

Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

PUA - Advanced Port Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·

Share on:

Detects the use of Advanced Port Scanner.

PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·

Share on:

Detects the execution of AdvancedRun utility

PUA - AdvancedRun Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·

Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

PUA - Chisel Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

PUA - CleanWipe Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.

PUA - Crassus Execution

Aug 12, 2024 · attack.discovery attack.t1590.001 ·

Share on:

Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.

PUA - CsExec Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 attack.execution attack.t1569.002 ·

Share on:

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

PUA - DefenderCheck Execution

Aug 12, 2024 · attack.defense-evasion attack.t1027.005 ·

Share on:

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

PUA - DIT Snapshot Viewer

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

PUA - Mouse Lock Execution

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·

Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

PUA - Netcat Suspicious Execution

Aug 12, 2024 · attack.command-and-control attack.t1095 ·

Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

PUA - NirCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

PUA - NirCmd Execution As LOCAL SYSTEM

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of NirCmd tool for command execution as SYSTEM user

PUA - Nmap/Zenmap Execution

Aug 12, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

PUA - NSudo Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of NSudo tool for command execution

PUA - Potential PE Metadata Tamper Using Rcedit

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·

Share on:

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

PUA - Radmin Viewer Utility Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·

Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

PUA - Rclone Execution

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

PUA - RunXCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

PUA - Seatbelt Execution

Aug 12, 2024 · attack.discovery attack.t1526 attack.t1087 attack.t1083 ·

Share on:

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Aug 12, 2024 · attack.discovery attack.t1087.002 ·

Share on:

Detects active directory enumeration activity using known AdFind CLI flags

PUA - WebBrowserPassView Execution

Aug 12, 2024 · attack.credential-access attack.t1555.003 ·

Share on:

Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera

PUA - Wsudo Suspicious Execution

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1059 ·

Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Pubprn.vbs Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216.001 ·

Share on:

Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.

Python Spawning Pretty TTY on Windows

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects python spawning a pretty tty

Query Usage To Exfil Data

Aug 12, 2024 · attack.execution ·

Share on:

Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Raccine Uninstall

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.

Rar Usage with Password and Compression Level

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

RDP Connection Allowed Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Read Contents From Stdin Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detect the use of "<" to read and potentially execute a file via cmd.exe

Recon Command Output Piped To Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1057 ·

Share on:

Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Recon Information for Export with Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Reg Add Suspicious Paths

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562.001 ·

Share on:

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Regedit as Trusted Installer

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·

Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

REGISTER_APP.VBS Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.

Registry Modification Via Regini.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Regsvr32 DLL Execution With Suspicious File Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects the execution of REGSVR32.exe with DLL files masquerading as other files

Regsvr32 DLL Execution With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1574 attack.execution ·

Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Regsvr32 Execution From Highly Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

Regsvr32 Execution From Potential Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.

Remote Access Tool - AnyDesk Piped Password Via CLI

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Remote Access Tool - AnyDesk Silent Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Remote Access Tool - GoToAssist Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - LogMeIn Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - NetSupport Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - RURAT Execution From Unusual Location

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')

Remote Access Tool - ScreenConnect Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Installation Execution

Aug 12, 2024 · attack.initial-access attack.t1133 ·

Share on:

Detects ScreenConnect program starts that establish a remote access to a system.

Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Remote Access Tool - UltraViewer Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Code Execute via Winrm.vbs

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects an attempt to execute code or create service on remote host via winrm.vbs.

Remote File Download Via Desktopimgdownldr Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Remote PowerShell Session Host Process (WinRM)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1021.006 ·

Share on:

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.

Remotely Hosted HTA File Executed Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.005 ·

Share on:

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Renamed AutoHotkey.EXE Execution

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of a renamed autohotkey.exe binary based on PE metadata fields

Renamed BOINC Client Execution

Aug 12, 2024 · attack.defense-evasion attack.t1553 ·

Share on:

Detects the execution of a renamed BOINC binary.

Renamed BrowserCore.EXE Execution

Aug 12, 2024 · attack.t1528 attack.t1036.003 ·

Share on:

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Renamed FTP.EXE Execution

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Renamed Gpg.EXE Execution

Aug 12, 2024 · attack.impact attack.t1486 ·

Share on:

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Renamed Jusched.EXE Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036.003 ·

Share on:

Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

Renamed Mavinject.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Renamed MegaSync Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.

Renamed Microsoft Teams Execution

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of a renamed Microsoft Teams binary.

Renamed Msdt.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects the execution of a renamed "Msdt.exe" binary

Renamed Office Binary Execution

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of a renamed office binary

Renamed Plink Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of a renamed version of the Plink binary

Renamed ProcDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms.

Renamed PsExec Service Execution

Aug 12, 2024 · attack.execution ·

Share on:

Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

Renamed Remote Utilities RAT (RURAT) Execution

Aug 12, 2024 · attack.defense-evasion attack.collection attack.command-and-control attack.discovery attack.s0592 ·

Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Renamed SysInternals DebugView Execution

Aug 12, 2024 · attack.resource-development attack.t1588.002 ·

Share on:

Detects suspicious renamed SysInternals DebugView execution

Renamed Sysinternals Sdelete Execution

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Renamed Visual Studio Code Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Renamed Whoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami that has been renamed to a different name to avoid detection

Replace.exe Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Root Certificate Installed From Susp Locations

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·

Share on:

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Ruby Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Run Once Task Execution as Configured in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

This rule detects the execution of Run Once task as configured in the registry

Run PowerShell Script from ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects PowerShell script execution from Alternate Data Stream (ADS)

Run PowerShell Script from Redirected Input Stream

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects PowerShell script execution via input stream redirect

Rundll32 Execution Without CommandLine Parameters

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Rundll32 Execution Without Parameters

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Rundll32 InstallScreenSaver Execution

Aug 12, 2024 · attack.t1218.011 attack.defense-evasion ·

Share on:

An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver

Rundll32 Registered COM Objects

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·

Share on:

load malicious registered COM objects

Rundll32 Spawned Via Explorer.EXE

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.

RunDLL32 Spawning Explorer

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

Rundll32 UNC Path Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1021.002 attack.t1218.011 ·

Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

SafeBoot Registry Key Deleted Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·

Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Scheduled Task Executing Payload from Registry

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Schtasks From Suspicious Folders

Aug 12, 2024 · attack.execution attack.t1053.005 ·

Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Screen Capture Activity Via Psr.EXE

Aug 12, 2024 · attack.collection attack.t1113 ·

Share on:

Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.

Script Event Consumer Spawning Process

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Script Interpreter Execution From Suspicious Folder

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Scripting/CommandLine Process Spawned Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.

Sdclt Child Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Security Privileges Enumeration Via Whoami.EXE

Aug 12, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·

Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Security Service Disabled Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects execution of "reg.exe" to disable security services such as Windows Defender.

Sensitive File Access Via Volume Shadow Copy Backup

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)

Service DACL Abuse To Hide Services Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Service Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Service Registry Key Deleted Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

Service Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Service Started/Stopped Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects usage of wmic to start or stop a service

Service StartupType Change Via PowerShell Set-Service

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Service StartupType Change Via Sc.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·

Share on:

Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"

Set Suspicious Files as System Files Using Attrib.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Shadow Copies Creation Using Operating Systems Utilities

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Share And Session Enumeration Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Shell Process Spawned by Java.EXE

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Shell32 DLL Execution in Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 ·

Share on:

Detects shell32.dll executing a DLL in a suspicious directory

ShimCache Flush

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects actions that clear the local ShimCache and remove forensic evidence

SQL Client Tools PowerShell Session Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

SQLite Chromium Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·

Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

SQLite Firefox Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.collection attack.t1005 ·

Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Start of NT Virtual DOS Machine

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications

Start Windows Service Via Net.EXE

Aug 12, 2024 · attack.execution attack.t1569.002 ·

Share on:

Detects the usage of the "net.exe" command to start a service using the "start" flag

Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·

Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Stop Windows Service Via Net.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service via the "net" utility.

Stop Windows Service Via PowerShell Stop-Service

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

Stop Windows Service Via Sc.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service via the "sc.exe" utility

Suspect Svchost Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Suspicious Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·

Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory.

Suspicious Advpack Call Via Rundll32.EXE

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function

Suspicious AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Suspicious Binary In User Directory Spawned From Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·

Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Suspicious Cabinet File Execution Via Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190

Suspicious Calculator Usage

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

Suspicious Certreq Command to Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Suspicious Child Process of AspNetCompiler

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects potentially suspicious child processes of "aspnet_compiler.exe".

Suspicious Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Suspicious Child Process Of Manage Engine ServiceDesk

Aug 12, 2024 · attack.command-and-control attack.t1102 ·

Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Suspicious Child Process Of Veeam Dabatase

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Suspicious CodePage Switch Via CHCP

Aug 12, 2024 · attack.t1036 attack.defense-evasion ·

Share on:

Detects a code page switch in command line or batch scripts to a rare language

Suspicious Control Panel DLL Load

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

Suspicious Copy From or To System Directory

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 ·

Share on:

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

Suspicious Csi.exe Usage

Aug 12, 2024 · attack.execution attack.t1072 attack.defense-evasion attack.t1218 ·

Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Suspicious Curl.EXE Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Suspicious CustomShellHost Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects the execution of CustomShellHost binary where the child isn't located in 'C:\Windows\explorer.exe'

Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·

Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Suspicious Desktopimgdownldr Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Suspicious Diantz Alternate Data Stream Execution

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.

Suspicious Diantz Download and Compress Into a CAB File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Download and compress a remote file and store it in a cab file on local machine.

Suspicious DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects when a user installs certificates by using CertOC.exe to load the target DLL file.

Suspicious Double Extension File Execution

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·

Share on:

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Suspicious Download From Direct IP Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Suspicious Download from Office Domain

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.t1608 ·

Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Suspicious Download Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with certain flags that allow the utility to download files.

Suspicious Driver Install by pnputil.exe

Aug 12, 2024 · attack.persistence attack.t1547 ·

Share on:

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Suspicious Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

Suspicious Electron Application Child Processes

Aug 12, 2024 · attack.execution ·

Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1027 ·

Share on:

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

Suspicious Encoded PowerShell Command Line

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Suspicious Execution From Outlook Temporary Folder

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·

Share on:

Detects a suspicious program execution in Outlook temp folder

Suspicious Execution Location Of Wermgr.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

Suspicious Execution of Hostname

Aug 12, 2024 · attack.discovery attack.t1082 ·

Share on:

Use of hostname to get information

Suspicious Execution of InstallUtil Without Log

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Uses the .NET InstallUtil.exe application in order to execute image without log

Suspicious Execution of Powershell with Base64

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Commandline to launch powershell with a base64 payload

Suspicious Execution of Shutdown

Aug 12, 2024 · attack.impact attack.t1529 ·

Share on:

Use of the commandline to shutdown or reboot windows

Suspicious Execution of Shutdown to Log Out

Aug 12, 2024 · attack.impact attack.t1529 ·

Share on:

Detects the rare use of the command line tool shutdown to logoff a user

Suspicious Execution of Systeminfo

Aug 12, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects usage of the "systeminfo" command to retrieve information

Suspicious Extrac32 Alternate Data Stream Execution

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Extract data from cab file and hide it in an alternate data stream

Suspicious Extrac32 Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Download or Copy file with Extrac32

Suspicious File Characteristics Due to Missing Fields

Aug 12, 2024 · attack.execution attack.t1059.006 ·

Share on:

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Suspicious File Download From IP Via Curl.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Suspicious File Download From IP Via Wget.EXE

Aug 12, 2024 · attack.execution ·

Share on:

Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

Suspicious File Downloaded From Direct IP Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Suspicious File Execution From Internet Hosted WebDav Share

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Suspicious Git Clone

Aug 12, 2024 · attack.reconnaissance attack.t1593.003 ·

Share on:

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 ·

Share on:

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Suspicious GrpConv Execution

Aug 12, 2024 · attack.persistence attack.t1547 ·

Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·

Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Suspicious IIS Module Registration

Aug 12, 2024 · attack.persistence attack.t1505.004 ·

Share on:

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Suspicious IIS URL GlobalRules Rewrite Via AppCmd

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.

Suspicious Invoke-WebRequest Execution With DirectIP

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Suspicious JavaScript Execution Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·

Share on:

Detects execution of javascript code using "mshta.exe".

Suspicious Kernel Dump Using Dtrace

Aug 12, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Suspicious Key Manager Access

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·

Share on:

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Suspicious Manipulation Of Default Accounts Via Net.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Suspicious Microsoft Office Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·

Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Suspicious Microsoft OneNote Child Process

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access ·

Share on:

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Suspicious Modification Of Scheduled Tasks

Aug 12, 2024 · attack.execution attack.t1053.005 ·

Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Suspicious Msbuild Execution By Uncommon Parent Process

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process

Suspicious MSDT Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·

Share on:

Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation

Suspicious MSHTA Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·

Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Suspicious Mshta.EXE Execution Patterns

Aug 12, 2024 · attack.execution attack.t1106 ·

Share on:

Detects suspicious mshta process execution patterns

Suspicious MsiExec Embedding Parent

Aug 12, 2024 · attack.t1218.007 attack.defense-evasion ·

Share on:

Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads

Suspicious Msiexec Execute Arbitrary DLL

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Suspicious Msiexec Quiet Install From Remote Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Suspicious Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Suspicious Network Command

Aug 12, 2024 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Suspicious New Service Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Suspicious NTLM Authentication on the Printer Spooler Service

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1212 ·

Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Suspicious Obfuscated PowerShell Code

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines

Suspicious Outlook Child Process

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects a suspicious process spawning from an Outlook process.

Suspicious Parent Double Extension File Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036.007 ·

Share on:

Detect execution of suspicious double extension files in ParentCommandLine

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·

Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Suspicious Ping/Del Command Combination

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·

Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Suspicious Powercfg Execution To Change Lock Screen Timeout

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout

Suspicious PowerShell Download and Execute Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Suspicious PowerShell Encoded Command Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Suspicious PowerShell IEX Execution Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Suspicious PowerShell Invocation From Script Engines

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell invocations from interpreters or unusual programs

Suspicious PowerShell Invocations - Specific - ProcessCreation

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious PowerShell invocation command parameters

Suspicious PowerShell Mailbox Export to Share

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Suspicious PowerShell Parameter Substring

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell invocation with a parameter substring

Suspicious PowerShell Parent Process

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Suspicious Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Suspicious Process Masquerading As SvcHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.

Suspicious Process Parents

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects suspicious parent processes that should not have any children or should only have a single possible child program

Suspicious Process Start Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036 car.2013-05-002 ·

Share on:

Detects suspicious process run from unusual locations

Suspicious Processes Spawned by WinRM

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

Suspicious Program Names

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Suspicious Provlaunch.EXE Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Suspicious Query of MachineGUID

Aug 12, 2024 · attack.discovery attack.t1082 ·

Share on:

Use of reg to get MachineGuid information

Suspicious RASdial Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects suspicious process related to rasdial.exe

Suspicious RDP Redirect Using TSCON

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects a suspicious RDP session redirect using tscon.exe

Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

Aug 12, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Suspicious Recursive Takeown

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·

Share on:

Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

Suspicious Redirection to Local Admin Share

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Suspicious Reg Add BitLocker

Aug 12, 2024 · attack.impact attack.t1486 ·

Share on:

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Suspicious Reg Add Open Command

Aug 12, 2024 · attack.credential-access attack.t1003 ·

Share on:

Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key

Suspicious Registry Modification From ADS Via Regini.EXE

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

Suspicious Regsvr32 Execution From Remote Share

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·

Share on:

Detects REGSVR32.exe to execute DLL hosted on remote shares

Suspicious Remote Child Process From Outlook

Aug 12, 2024 · attack.execution attack.t1059 attack.t1202 ·

Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Suspicious RunAs-Like Flag Combination

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Suspicious Rundll32 Activity Invoking Sys File

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

Suspicious Rundll32 Execution With Image Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects the execution of Rundll32.exe with DLL files masquerading as image files

Suspicious Rundll32 Invoking Inline VBScript

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Suspicious Rundll32 Setupapi.dll Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Suspicious Runscripthelper.exe

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Suspicious Scan Loop Network

Aug 12, 2024 · attack.execution attack.t1059 attack.discovery attack.t1018 ·

Share on:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Suspicious Scheduled Task Creation Involving Temp Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 ·

Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Suspicious Scheduled Task Name As GUID

Aug 12, 2024 · attack.execution attack.t1053.005 ·

Share on:

Detects creation of a scheduled task with a GUID like name

Suspicious Schtasks Execution AppData Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Suspicious Schtasks Schedule Type With High Privileges

Aug 12, 2024 · attack.execution attack.t1053.005 ·

Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Suspicious Schtasks Schedule Types

Aug 12, 2024 · attack.execution attack.t1053.005 ·

Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Suspicious ScreenSave Change by Reg.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1546.002 ·

Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Suspicious Script Execution From Temp Folder

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects a suspicious script executions from temporary folder

Suspicious Serv-U Process Pattern

Aug 12, 2024 · attack.credential-access attack.t1555 cve.2021-35211 ·

Share on:

Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

Suspicious Service Binary Directory

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects a service binary running in a suspicious directory

Suspicious Service DACL Modification Via Set-Service Cmdlet

Aug 12, 2024 · attack.persistence attack.t1543.003 ·

Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Suspicious Service Path Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·

Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Suspicious Shells Spawn by Java Utility Keytool

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Suspicious Splwow64 Without Params

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects suspicious Splwow64.exe process without any command line parameters

Suspicious SysAidServer Child

Aug 12, 2024 · attack.lateral-movement attack.t1210 ·

Share on:

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Suspicious SYSVOL Domain Group Policy Access

Aug 12, 2024 · attack.credential-access attack.t1552.006 ·

Share on:

Detects Access to Domain Group Policies stored in SYSVOL

Suspicious TSCON Start as SYSTEM

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Suspicious UltraVNC Execution

Aug 12, 2024 · attack.lateral-movement attack.g0047 attack.t1021.005 ·

Share on:

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Suspicious Use of CSharp Interactive Console

Aug 12, 2024 · attack.execution attack.t1127 ·

Share on:

Detects the execution of CSharp interactive console by PowerShell

Suspicious Use of PsLogList

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·

Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Suspicious Userinit Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects a suspicious child process of userinit

Suspicious VBoxDrvInst.exe Parameters

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys

Suspicious Vsls-Agent Command With AgentExtensionPath Load

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter

Suspicious WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 cve.2023-23397 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Suspicious Where Execution

Aug 12, 2024 · attack.discovery attack.t1217 ·

Share on:

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1070.001 ·

Share on:

Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

Suspicious Windows Update Agent Empty Cmdline

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

Suspicious WindowsTerminal Child Processes

Aug 12, 2024 · attack.execution attack.persistence ·

Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Suspicious WMIC Execution Via Office Process

Aug 12, 2024 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense-evasion ·

Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Suspicious WmiPrvSE Child Process

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·

Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Suspicious Workstation Locking via Rundll32

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects a suspicious call to the user32.dll function that locks the user workstation

Suspicious X509Enrollment - Process Creation

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·

Share on:

Detect use of X509Enrollment

Suspicious XOR Encoded PowerShell Command

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1140 attack.t1027 ·

Share on:

Detects presence of a potentially xor encoded powershell command

Suspicious ZipExec Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.

SyncAppvPublishingServer Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.

SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1216 ·

Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs

Sysinternals PsService Execution

Aug 12, 2024 · attack.discovery attack.persistence attack.t1543.003 ·

Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Sysinternals PsSuspend Execution

Aug 12, 2024 · attack.discovery attack.persistence attack.t1543.003 ·

Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Sysinternals PsSuspend Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Sysmon Configuration Update

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely

Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

Sysmon Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·

Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Sysprep on AppData Folder

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

System File Execution Location Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.

System Network Connections Discovery Via Net.EXE

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Tamper Windows Defender Remove-MpPreference

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet

Tap Installer Execution

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

Taskkill Symantec Endpoint Protection

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects one of the possible scenarios for disabling Symantec Endpoint Protection. Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism. As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.

Taskmgr as LOCAL_SYSTEM

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM

Terminal Service Process Spawn

Aug 12, 2024 · attack.initial-access attack.t1190 attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Time Travel Debugging Utility Usage

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1218 attack.t1003.001 ·

Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Tor Client/Browser Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·

Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

TrustedPath UAC Bypass Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·

Share on:

Detects indicators of a UAC bypass method by mocking directories

UAC Bypass Using Event Viewer RecentViews

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·

Share on:

Detects the pattern of UAC Bypass using Event Viewer RecentViews

UAC Bypass via ICMLuaUtil

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

UAC Bypass via Windows Firewall Snap-In Hijack

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·

Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

UEFI Persistence Via Wpbbin - ProcessCreation

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1542.001 ·

Share on:

Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".

Uncommon AddinUtil.EXE CommandLine Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.

Uncommon Child Process Of AddinUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.

Uncommon Child Process Of Appvlp.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·

Share on:

Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file.

Uncommon Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Uncommon Child Process Of Defaultpack.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·

Share on:

Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs

Uncommon Child Process Of Setres.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.

Uncommon Child Process Spawned By Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.

Uncommon Child Processes Of SndVol.exe

Aug 12, 2024 · attack.execution ·

Share on:

Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)

Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·

Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Uncommon FileSystem Load Attempt By Format.com

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

Uncommon Link.EXE Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.

Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·

Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Uncommon Svchost Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects an uncommon svchost parent process

Uncommon Userinit Child Process

Aug 12, 2024 · attack.t1037.001 attack.persistence ·

Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Uninstall Crowdstrike Falcon Sensor

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

Uninstall Sysinternals Sysmon

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the removal of Sysmon, which could be a potential attempt at defense evasion

Unmount Share Via Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·

Share on:

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Unsigned AppX Installation Attempt Using Add-AppxPackage

Aug 12, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Unusual Child Process of dns.exe

Aug 12, 2024 · attack.initial-access attack.t1133 ·

Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Usage Of Web Request Commands And Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Use Icacls to Hide File to Everyone

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Use NTFS Short Name in Command Line

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Use NTFS Short Name in Image

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection

Use of FSharp Interpreters

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

Use of OpenConsole

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Use of Pcalua For Execution

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Use of Remote.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.

Use of Scriptrunner.exe

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting

Use Of The SFTP.EXE Binary As A LOLBIN

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag

Use of TTDInject.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)

Use of UltraVNC Remote Access Software

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Use of VisualUiaVerifyNative.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Use of VSIISExeLauncher.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries

Use of W32tm as Timer

Aug 12, 2024 · attack.discovery attack.t1124 ·

Share on:

When configured with suitable command line arguments, w32tm can act as a delay mechanism

Use of Wfc.exe

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Use Short Name Path in Command Line

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Use Short Name Path in Image

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

User Added To Highly Privileged Group

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

User Added to Local Administrators Group

Aug 12, 2024 · attack.persistence attack.t1098 ·

Share on:

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

User Added to Remote Desktop Users Group

Aug 12, 2024 · attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·

Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

User Discovery And Export Via Get-ADUser Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Using SettingSyncHost.exe as LOLBin

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1574.008 ·

Share on:

Detects using SettingSyncHost.exe to run hijacked binary

UtilityFunctions.ps1 Proxy Dll

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.

Veeam Backup Database Suspicious Query

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

Detects dump of credentials in VeeamBackup dbo

Verclsid.exe Runs COM Object

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects when verclsid.exe is used to run COM object via GUID

Visual Basic Command Line Compiler Usage

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·

Share on:

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary

Visual Studio NodejsTools PressAnyKey Renamed Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries

VMToolsd Suspicious Child Process

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·

Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

VolumeShadowCopy Symlink Creation Via Mklink

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies storage symbolic link creation using operating systems utilities

Wab Execution From Non Default Location

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

Wab/Wabmig Unusual Parent Or Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

Weak or Abused Passwords In CLI

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).

Webshell Tool Reconnaissance Activity

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

WhoAmI as Parameter

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Whoami Utility Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation

Windows Admin Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when an admin share is mounted using net.exe

Windows Backup Deleted Via Wbadmin.EXE

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Windows Credential Manager Access via VaultCmd

Aug 12, 2024 · attack.credential-access attack.t1555.004 ·

Share on:

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Windows Defender Definition Files Removed

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

Windows Firewall Disabled via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects attempts to disable the Windows Firewall using PowerShell

Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

Windows Internet Hosted WebDav Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Windows Kernel Debugger Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·

Share on:

Detects execution of the Windows Kernel Debugger "kd.exe".

Windows Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when a share is mounted using the "net.exe" utility

Windows Shell/Scripting Processes Spawning Suspicious Programs

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·

Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Winrar Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Winrar Execution in Non-Standard Folder

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects a suspicious winrar execution in a folder which is not the default installation folder

Wlrmdr.EXE Uncommon Argument Or Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.

WMI Backdoor Exchange Transport Agent

Aug 12, 2024 · attack.persistence attack.t1546.003 ·

Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·

Share on:

Detects WMI script event consumers

WMIC Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of WMIC to query information on a remote system

WmiPrvSE Spawned A Process

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects WmiPrvSE spawning a process

Write Protect For Storage Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.

Writing Of Malicious Files To The Fonts Folder

Aug 12, 2024 · attack.t1211 attack.t1059 attack.defense-evasion attack.persistence ·

Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Wscript Shell Run In CommandLine

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

WSL Child Process Anomaly

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL

XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

XSL Script Execution Via WMIC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of WMIC with the "format" flag to potentially load XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.