attack.collection

7Zip Compressing Dump Files

Sep 7, 2023 · attack.collection attack.t1560.001 ·

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Copy from Admin Share

Sep 7, 2023 · attack.lateral_movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a suspicious copy command to or from an Admin share or remote

Winrar Compressing Dump Files

Sep 7, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Winrar Execution in Non-Standard Folder

Sep 7, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects a suspicious winrar execution in a folder which is not the default installation folder

CredUI.DLL Loaded By Uncommon Process

Jul 31, 2023 · attack.credential_access attack.collection attack.t1056.002 ·

Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Psr.exe Capture Screenshots

Jun 26, 2023 · attack.collection attack.t1113 ·

Share on:

The psr.exe captures desktop screenshots and saves them on the local machine

Conti NTDS Exfiltration Command

Jun 20, 2023 · attack.collection attack.t1560 detection.emerging_threats ·

Share on:

Detects a command used by conti to exfiltrate NTDS

Potential Conti Ransomware Database Dumping Activity Via SQLCmd

Jun 20, 2023 · attack.collection attack.t1005 detection.emerging_threats ·

Share on:

Detects a command used by conti to dump database

PowerShell Get Clipboard

May 15, 2023 · attack.collection attack.t1115 ·

Share on:

A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.

Zip A Folder With PowerShell For Staging In Temp - PowerShell Module

May 15, 2023 · attack.collection attack.t1074.001 ·

Share on:

Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration

Veeam Backup Database Suspicious Query

May 9, 2023 · attack.collection attack.t1005 ·

Share on:

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

ADFS Database Named Pipe Connection

Apr 20, 2023 · attack.collection attack.t1005 ·

Share on:

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

Audio Capture via PowerShell

Apr 11, 2023 · attack.collection attack.t1123 ·

Share on:

Detects audio capture via PowerShell Cmdlet.

Exchange PowerShell Snap-Ins Usage

Mar 24, 2023 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·

Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Compress Data and Lock With Password for Exfiltration With 7-ZIP

Mar 13, 2023 · attack.collection attack.t1560.001 ·

Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Password Protected Compressed File Extraction Via 7Zip

Mar 11, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.

Audio Capture via SoundRecorder

Mar 5, 2023 · attack.collection attack.t1123 ·

Share on:

Detect attacker collecting audio via SoundRecorder application.

Compress Data and Lock With Password for Exfiltration With WINZIP

Mar 2, 2023 · attack.collection attack.t1560.001 ·

Share on:

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Rar Usage with Password and Compression Level

Mar 2, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

Zip A Folder With PowerShell For Staging In Temp

Mar 2, 2023 · attack.collection attack.t1074.001 ·

Share on:

Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration

System Drawing DLL Load

Feb 23, 2023 · attack.collection attack.t1113 ·

Share on:

Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.

Data Copied To Clipboard Via Clip.EXE

Feb 22, 2023 · attack.collection attack.t1115 ·

Share on:

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Automated Collection Command Prompt

Feb 21, 2023 · attack.collection attack.t1119 attack.credential_access attack.t1552.001 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

PUA - Mouse Lock Execution

Feb 21, 2023 · attack.credential_access attack.collection attack.t1056.002 ·

Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Suspicious Manipulation Of Default Accounts Via Net.EXE

Feb 21, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Feb 13, 2023 · attack.collection attack.t1005 ·

Share on:

Detects dump of credentials in VeeamBackup dbo

PowerShell Get-Clipboard Cmdlet Via CLI

Feb 7, 2023 · attack.collection attack.t1115 ·

Share on:

Detects usage of the 'Get-Clipboard' cmdlet via CLI

Github Self Hosted Runner Changes Detected

Feb 6, 2023 · attack.impact attack.discovery attack.collection attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Files Added To An Archive Using Rar.EXE

Feb 6, 2023 · attack.collection attack.t1560.001 ·

Share on:

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Renamed Remote Utilities RAT (RURAT) Execution

Feb 3, 2023 · attack.defense_evasion attack.collection attack.command_and_control attack.discovery attack.s0592 ·

Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

iOS Implant URL Pattern

Feb 1, 2023 · attack.execution attack.t1203 attack.collection attack.t1005 attack.t1119 attack.credential_access attack.t1528 attack.t1552.001 ·

Share on:

Detects URL pattern used by iOS Implant

Potential Keylogger Activity

Feb 1, 2023 · attack.collection attack.credential_access attack.t1056.001 ·

Share on:

Detects PowerShell scripts that contains reference to keystroke capturing functions

WinDivert Driver Load

Feb 1, 2023 · attack.collection attack.defense_evasion attack.t1599.001 attack.t1557.001 ·

Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Clipboard Data Collection Via OSAScript

Jan 31, 2023 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·

Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Github Delete Action Invoked

Jan 30, 2023 · attack.impact attack.collection attack.t1213.003 ·

Share on:

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Github Outside Collaborator Detected

Jan 30, 2023 · attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·

Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Cisco BGP Authentication Failures

Jan 23, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Huawei BGP Authentication Failures

Jan 23, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Juniper BGP Missing MD5

Jan 23, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

SQLite Firefox Profile Data DB Access

Jan 20, 2023 · attack.credential_access attack.t1539 attack.collection attack.t1005 ·

Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

SQLite Chromium Profile Data DB Access

Jan 20, 2023 · attack.credential_access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·

Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Recon Information for Export with Command Prompt

Jan 19, 2023 · attack.collection attack.t1119 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Cisco LDP Authentication Failures

Jan 12, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Audio Capture

Jan 10, 2023 · attack.collection attack.t1123 ·

Share on:

Detects attempts to record audio with arecord utility

Clipboard Collection of Image Data with Xclip Tool

Jan 10, 2023 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Clipboard Collection with Xclip Tool - Auditd

Jan 10, 2023 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Screen Capture with Import Tool

Jan 10, 2023 · attack.collection attack.t1113 ·

Share on:

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.

Screen Capture with Xwd

Jan 10, 2023 · attack.collection attack.t1113 ·

Share on:

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

Cisco Collect Data

Jan 4, 2023 · attack.discovery attack.credential_access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·

Share on:

Collect pertinent data from the configuration files

Cisco Stage Data

Jan 4, 2023 · attack.collection attack.lateral_movement attack.command_and_control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Automated Collection Command PowerShell

Jan 4, 2023 · attack.collection attack.t1119 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Powershell Keylogging

Jan 4, 2023 · attack.collection attack.t1056.001 ·

Share on:

Adversaries may log user keystrokes to intercept credentials as the user types them.

Powershell Local Email Collection

Jan 4, 2023 · attack.collection attack.t1114.001 ·

Share on:

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.

Recon Information for Export with PowerShell

Jan 4, 2023 · attack.collection attack.t1119 ·

Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data

Windows Screen Capture with CopyFromScreen

Jan 4, 2023 · attack.collection attack.t1113 ·

Share on:

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations

Zip A Folder With PowerShell For Staging In Temp - PowerShell Script

Jan 4, 2023 · attack.collection attack.t1074.001 ·

Share on:

Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration

Suspicious Access to Sensitive File Extensions

Dec 27, 2022 · attack.collection attack.t1039 ·

Share on:

Detects known sensitive file extensions accessed on a network share

Suspicious Access to Sensitive File Extensions - Zeek

Dec 27, 2022 · attack.collection ·

Share on:

Detects known sensitive file extensions via Zeek

Linux Capabilities Discovery

Dec 27, 2022 · attack.collection attack.privilege_escalation attack.t1123 attack.t1548 ·

Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Zip A Folder With PowerShell For Staging In Temp - PowerShell

Dec 2, 2022 · attack.collection attack.t1074.001 ·

Share on:

Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration

PST Export Alert Using eDiscovery Alert

Nov 18, 2022 · attack.collection attack.t1114 ·

Share on:

Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content

PST Export Alert Using New-ComplianceSearchAction

Nov 18, 2022 · attack.collection attack.t1114 ·

Share on:

Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.

Esentutl Steals Browser Information

Oct 31, 2022 · attack.collection attack.t1005 ·

Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Processes Accessing the Microphone and Webcam

Oct 25, 2022 · attack.collection attack.t1123 ·

Share on:

Potential adversaries accessing the microphone and webcam in an endpoint.

Screen Capture - macOS

Oct 25, 2022 · attack.collection attack.t1113 ·

Share on:

Detects attempts to use screencapture to collect macOS screenshots

Clipboard Collection with Xclip Tool

Oct 25, 2022 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

AWS EC2 VM Export Failure

Oct 25, 2022 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·

Share on:

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Google Full Network Traffic Packet Capture

Oct 9, 2022 · attack.collection attack.t1074 ·

Share on:

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.