attack.command-and-control

Antivirus Exploitation Framework Detection

Nov 4, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Cloudflared Tunnels Related DNS Requests

Nov 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects the execution of a renamed "cloudflared" binary.

Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·

Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Oct 25, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

New Connection Initiated To Potential Dead Drop Resolver Domain

Oct 25, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·

Share on:

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

DNS Query To Devtunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

DNS Query To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

DNS Query To Remote Access Software Domain From Non-Browser App

Sep 13, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Incoming Connection

Sep 2, 2024 · attack.persistence attack.command-and-control attack.t1219 ·

Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Diamond Sleet APT DNS Communication Indicators

Sep 2, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects DNS queries related to Diamond Sleet APT activity

File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·

Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Renamed VsCode Code Tunnel Execution - File Indicator

Sep 2, 2024 · attack.command-and-control ·

Share on:

Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.

Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Visual Studio Code Tunnel Remote File Creation

Sep 2, 2024 · attack.command-and-control ·

Share on:

Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature

Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

DNS Query To Put.io - DNS Client

Aug 23, 2024 · attack.command-and-control ·

Share on:

Detects DNS queries for subdomains related to "Put.io" sharing website.

Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Aug 23, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Activity from Anonymous IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Activity from Infrequent Country

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

Activity from Suspicious IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

ADSI-Cache File Creation By Uncommon Tool

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·

Share on:

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Anydesk Temporary Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

AppX Package Installation Attempts Via AppInstaller.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

APT User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·

Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of Chromium based browser in headless mode

Chafer Malware URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects HTTP request used by Chafer malware to receive data from its C2.

Change User Agents with WebRequest

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Cobalt Strike DNS Beaconing

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Communication To Uncommon Destination Ports

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·

Share on:

Detects programs that connect to uncommon destination ports

ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·

Share on:

Detects Turla ComRAT network communication.

Crypto Miner User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Curl Usage on Linux

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Default Cobalt Strike Certificate

Aug 12, 2024 · attack.command-and-control attack.s0154 ·

Share on:

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Devil Bait Potential C2 Communication Traffic

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication related to Devil Bait malware

DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·

Share on:

Well-known DNS Exfiltration tools execution

DNS Query To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

DNS Query Tor .Onion Address - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·

Share on:

Detects DNS queries to an ".onion" address related to Tor routing networks

DNS TXT Answer with Possible Execution Strings

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·

Share on:

Detects strings used in command execution in DNS TXT Answer

Download File To Potentially Suspicious Directory Via Wget

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of wget to download content to a suspicious directory

Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·

Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

DPRK Threat Actor - C2 Communication DNS Indicators

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects DNS queries for C2 domains used by DPRK Threat actors.

Equation Group C2 Communication

Aug 12, 2024 · attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·

Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Executable from Webdav

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

Exploit Framework User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download and execute files

File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects when a user downloads a file by using CertOC.exe

File Download Via Nscurl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 ·

Share on:

Detects the execution of the nscurl utility in order to download files.

File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

GALLIUM Artefacts - Builtin

Aug 12, 2024 · attack.credential-access attack.command-and-control attack.t1071 detection.emerging-threats ·

Share on:

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

GALLIUM IOCs

Aug 12, 2024 · attack.credential-access attack.command-and-control attack.t1212 attack.t1071 attack.g0093 detection.emerging-threats ·

Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Goofy Guineapig Backdoor Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication related to Goofy Guineapig backdoor

GoToAssist Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Gzip Archive Decode Via PowerShell

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·

Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

HackTool - BabyShark Agent Default URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Baby Shark C2 Framework default communication patterns

HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects user agent and URI paths used by empire agents

HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·

Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

HackTool - Inveigh Execution Artefacts

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the presence and execution of Inveigh via dropped artefacts

HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects usage of the Sharp Chisel via the commandline arguments

HackTool - SILENTTRINITY Stager DLL Load

Aug 12, 2024 · attack.command-and-control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager dll loading activity

HackTool - SILENTTRINITY Stager Execution

Aug 12, 2024 · attack.command-and-control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager use via PE metadata

Hijack Legit RDP Session to Move Laterally

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Installation of TeamViewer Desktop

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

TeamViewer_Desktop.exe is create during install

Local Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Malware User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by malware in proxy logs

Mesh Agent Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Netcat The Powershell Version

Aug 12, 2024 · attack.command-and-control attack.t1095 ·

Share on:

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Network Communication Initiated To Portmap.IO Domain

Aug 12, 2024 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·

Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Network Connection Initiated By IMEWDBLD.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

Network Connection Initiated To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·

Share on:

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Network Connection Initiated To Cloudflared Tunnels Domains

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567.001 ·

Share on:

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Network Connection Initiated Via Notepad.EXE

Aug 12, 2024 · attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·

Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

New Kind of Network (NKN) Detection

Aug 12, 2024 · attack.command-and-control ·

Share on:

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

New Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

Ngrok Usage with Remote Desktop Service

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

Office Application Initiated Network Connection Over Uncommon Ports

Aug 12, 2024 · attack.defense-evasion attack.command-and-control ·

Share on:

Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.

OilRig APT Activity

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·

Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

OilRig APT Registry Persistence

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·

Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

OilRig APT Schedule Task Persistence - Security

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·

Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

OilRig APT Schedule Task Persistence - System

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·

Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Okta Security Threat Detected

Aug 12, 2024 · attack.command-and-control ·

Share on:

Detects when an security threat is detected in Okta.

OpenCanary - Telnet Login Attempt

Aug 12, 2024 · attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·

Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Outbound Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Outbound Network Connection To Public IP Via Winlogon

Aug 12, 2024 · attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 ·

Share on:

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Outlook Macro Execution Without Warning Setting Enabled

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Pandemic Registry Key

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects Pandemic Windows Implant

Password Protected ZIP File Opened (Suspicious Filenames)

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

Potential Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Potential COM Objects Download Cradles Usage - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential COM Objects Download Cradles Usage - PS Script

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp ICO C2 File Download

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Potential CSharp Streamer RAT Loading .NET Executable Image

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

Potential CVE-2023-36884 Exploitation - File Downloads

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Potential CVE-2023-36884 Exploitation - Share Access

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

Potential CVE-2023-36884 Exploitation - URL Marker

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Potential CVE-2023-36884 Exploitation Pattern

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Potential CVE-2303-36884 URL Request Pattern Traffic

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Potential Download/Upload Activity Using Type Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Potential Linux Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential Operation Triangulation C2 Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·

Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Potential Operation Triangulation C2 Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·

Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Potential Peach Sandstorm APT C2 Communication Activity

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication activity related to Peach Sandstorm APT

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Potential Pikabot C2 Activity

Aug 12, 2024 · attack.command-and-control attack.t1573 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Execution of plink to perform data exfiltration and tunneling

Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Potential Remote Desktop Connection to Non-Domain Host

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects logons using NTLM to hosts that are potentially not part of the domain.

Potential SocGholish Second Stage C2 DNS Query

Aug 12, 2024 · attack.command-and-control attack.t1219 detection.emerging-threats ·

Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Potential Suspicious Child Process Of 3CXDesktopApp

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1218 detection.emerging-threats ·

Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Potential WizardUpdate Malware Infection

Aug 12, 2024 · attack.command-and-control ·

Share on:

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Potentially Suspicious Malware Callback Communication

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·

Share on:

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

Potentially Suspicious Malware Callback Communication - Linux

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·

Share on:

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Potentially Suspicious Network Connection To Notion API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·

Share on:

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Potentially Suspicious Usage Of Qemu

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.t1572 ·

Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·

Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·

Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Detects the use of 3proxy, a tiny free proxy server

PUA - Chisel Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·

Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

PUA - Fast Reverse Proxy (FRP) Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

PUA - Netcat Suspicious Execution

Aug 12, 2024 · attack.command-and-control attack.t1095 ·

Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

PUA - Nimgrab Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

PUA - NPS Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

PUA- IOX Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

PwnDrp Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·

Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Query Tor Onion Address - DNS Client

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·

Share on:

Detects DNS resolution of an .onion address related to Tor routing networks

Raw Paste Service Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 attack.defense-evasion ·

Share on:

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Remote Access Tool - AnyDesk Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - Anydesk Execution From Suspicious Folder

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Piped Password Via CLI

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Remote Access Tool - AnyDesk Silent Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Remote Access Tool - GoToAssist Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - LogMeIn Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - NetSupport Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Remote Access Tool - Simple Help Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - UltraViewer Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote File Copy

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1105 ·

Share on:

Detects the use of tools that copy files from or to remote systems

Remote File Download Via Desktopimgdownldr Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Renamed Remote Utilities RAT (RURAT) Execution

Aug 12, 2024 · attack.defense-evasion attack.collection attack.command-and-control attack.discovery attack.s0592 ·

Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Renamed Visual Studio Code Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Replace.exe Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Replace.exe which can be used to replace file with another file

ScreenConnect Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Sign-In From Malware Infected IP

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·

Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Small Sieve Malware Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·

Share on:

Detects potential C2 communication related to Small Sieve malware

Suspicious Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Suspicious Binary Writes Via AnyDesk

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Suspicious C2 Activities

Aug 12, 2024 · attack.command-and-control ·

Share on:

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

Suspicious Certreq Command to Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Suspicious Child Process Of Manage Engine ServiceDesk

Aug 12, 2024 · attack.command-and-control attack.t1102 ·

Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Suspicious Cobalt Strike DNS Beaconing - DNS Client

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·

Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Suspicious Cobalt Strike DNS Beaconing - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·

Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Suspicious Curl Change User Agents - Linux

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects a suspicious curl process start on linux with set useragent options

Suspicious Curl.EXE Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Suspicious Desktopimgdownldr Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Suspicious Desktopimgdownldr Target File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Suspicious Diantz Download and Compress Into a CAB File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Download and compress a remote file and store it in a cab file on local machine.

Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries using base64 encoding

Suspicious DNS Z Flag Bit Set

Aug 12, 2024 · attack.t1095 attack.t1571 attack.command-and-control ·

Share on:

The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

Suspicious Download from Office Domain

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.t1608 ·

Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Suspicious Dropbox API Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Suspicious Extrac32 Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Download or Copy file with Extrac32

Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Suspicious FromBase64String Usage On Gzip Archive - Ps Script

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.

Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Suspicious Invoke-WebRequest Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Suspicious Invoke-WebRequest Execution With DirectIP

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Suspicious LDAP-Attributes Used

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·

Share on:

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

Suspicious Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Suspicious Non-Browser Network Communication With Google API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·

Share on:

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)

Suspicious Non-Browser Network Communication With Telegram API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·

Share on:

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Suspicious Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·

Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Suspicious SSL Connection

Aug 12, 2024 · attack.command-and-control attack.t1573 ·

Share on:

Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Suspicious TCP Tunnel Via PowerShell Script

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity

Suspicious TSCON Start as SYSTEM

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Suspicious User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious malformed user agent strings in proxy logs

TacticalRMM Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

TeamViewer Domain Query By Non-TeamViewer Application

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

TeamViewer Remote Session

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

Detects the creation of log files during a TeamViewer remote session

Telegram API Access

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.t1102.002 ·

Share on:

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Telegram Bot API Request

Aug 12, 2024 · attack.command-and-control attack.t1102.002 ·

Share on:

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Testing Usage of Uncommonly Used Port

Aug 12, 2024 · attack.command-and-control attack.t1571 ·

Share on:

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.

Tor Client/Browser Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·

Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

Uncommon Network Connection Initiated By Certutil.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Ursnif Malware C2 URL Pattern

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1204.002 attack.command-and-control attack.t1071.001 ·

Share on:

Detects Ursnif C2 traffic.

Ursnif Malware Download URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects download of Ursnif malware done by dropper documents.

Use of UltraVNC Remote Access Software

Aug 12, 2024 · attack.command-and-control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Wannacry Killswitch Domain

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects wannacry killswitch domain dns queries

Wget Creating Files in Tmp Directory

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Windows PowerShell User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·