attack.command-and-control | Detection.FYI

DNS Query To Remote Access Software Domain From Non-Browser App

Dec 19, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
QuickAssist Execution

Dec 19, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Read More
Potential Peach Sandstorm APT C2 Communication Activity

Dec 1, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication activity related to Peach Sandstorm APT

Read More
Potential Pikabot C2 Activity

Dec 1, 2024 · attack.command-and-control attack.t1573 detection.emerging-threats ·
Share on:

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Read More
GALLIUM IOCs

Nov 25, 2024 · attack.credential-access attack.command-and-control attack.t1212 attack.t1071 attack.g0093 detection.emerging-threats ·
Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Read More
PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

Read More
PUA - Nimgrab Execution

Nov 25, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

Read More
PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

Read More
PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Read More
Antivirus Exploitation Framework Detection

Nov 4, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·
Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Read More
Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Read More
Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Read More
Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Read More
Cloudflared Tunnels Related DNS Requests

Nov 1, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of a renamed "cloudflared" binary.

Read More
Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·
Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

Read More
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Oct 25, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

Read More
New Connection Initiated To Potential Dead Drop Resolver Domain

Oct 25, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·
Share on:

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

Read More
DNS Query To Devtunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
DNS Query To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Remote Access Tool - MeshAgent Command Execution via MeshCentral

Sep 22, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Read More
Remote Access Tool - AnyDesk Incoming Connection

Sep 2, 2024 · attack.persistence attack.command-and-control attack.t1219 ·
Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Read More
DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
Diamond Sleet APT DNS Communication Indicators

Sep 2, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects DNS queries related to Diamond Sleet APT activity

Read More
File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·
Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Read More
Renamed VsCode Code Tunnel Execution - File Indicator

Sep 2, 2024 · attack.command-and-control ·
Share on:

Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.

Read More
Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Visual Studio Code Tunnel Remote File Creation

Sep 2, 2024 · attack.command-and-control ·
Share on:

Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature

Read More
Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Read More
Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

Read More
DNS Query To Put.io - DNS Client

Aug 23, 2024 · attack.command-and-control ·
Share on:

Detects DNS queries for subdomains related to "Put.io" sharing website.

Read More
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Aug 23, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Read More
Activity from Anonymous IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
Activity from Infrequent Country

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

Read More
Activity from Suspicious IP Addresses

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

Read More
ADSI-Cache File Creation By Uncommon Tool

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·
Share on:

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Read More
Anydesk Temporary Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
AppX Package Installation Attempts Via AppInstaller.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

Read More
APT User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

Read More
APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·
Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Read More
Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Read More
Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read More
Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Read More
Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of Chromium based browser in headless mode

Read More
Chafer Malware URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects HTTP request used by Chafer malware to receive data from its C2.

Read More
Change User Agents with WebRequest

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Read More
Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·
Share on:

Various protocols maybe used to put data on the device for exfil or infil

Read More
Cobalt Strike DNS Beaconing

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

Read More
Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·
Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Read More
Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Read More
Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Read More
Communication To Uncommon Destination Ports

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to uncommon destination ports

Read More
ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·
Share on:

Detects Turla ComRAT network communication.

Read More
Crypto Miner User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Read More
Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Read More
Curl Usage on Linux

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Read More
Default Cobalt Strike Certificate

Aug 12, 2024 · attack.command-and-control attack.s0154 ·
Share on:

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Read More
Devil Bait Potential C2 Communication Traffic

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication related to Devil Bait malware

Read More
DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·
Share on:

Well-known DNS Exfiltration tools execution

Read More
DNS Query To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Read More
DNS Query Tor .Onion Address - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects DNS queries to an ".onion" address related to Tor routing networks

Read More
DNS TXT Answer with Possible Execution Strings

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects strings used in command execution in DNS TXT Answer

Read More
Download File To Potentially Suspicious Directory Via Wget

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of wget to download content to a suspicious directory

Read More
Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·
Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Read More
DPRK Threat Actor - C2 Communication DNS Indicators

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects DNS queries for C2 domains used by DPRK Threat actors.

Read More
Equation Group C2 Communication

Aug 12, 2024 · attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·
Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Read More
Executable from Webdav

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

Read More
Exploit Framework User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Read More
File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the IEExec utility to download and execute files

Read More
File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

Read More
File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

Read More
File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects when a user downloads a file by using CertOC.exe

Read More
File Download Via Nscurl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of the nscurl utility in order to download files.

Read More
File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

Read More
File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Read More
Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Read More
GALLIUM Artefacts - Builtin

Aug 12, 2024 · attack.credential-access attack.command-and-control attack.t1071 detection.emerging-threats ·
Share on:

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Read More
Goofy Guineapig Backdoor Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication related to Goofy Guineapig backdoor

Read More
GoToAssist Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·
Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Read More
Gzip Archive Decode Via PowerShell

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

Read More
HackTool - BabyShark Agent Default URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects Baby Shark C2 Framework default communication patterns

Read More
HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Read More
HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects user agent and URI paths used by empire agents

Read More
HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·
Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Read More
HackTool - Inveigh Execution Artefacts

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the presence and execution of Inveigh via dropped artefacts

Read More
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

Read More
HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Sharp Chisel via the commandline arguments

Read More
HackTool - SILENTTRINITY Stager DLL Load

Aug 12, 2024 · attack.command-and-control attack.t1071 ·
Share on:

Detects SILENTTRINITY stager dll loading activity

Read More
HackTool - SILENTTRINITY Stager Execution

Aug 12, 2024 · attack.command-and-control attack.t1071 ·
Share on:

Detects SILENTTRINITY stager use via PE metadata

Read More
Hijack Legit RDP Session to Move Laterally

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Read More
HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Read More
Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·
Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Read More
Installation of TeamViewer Desktop

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

TeamViewer_Desktop.exe is create during install

Read More
Local Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Read More
Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Read More
Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·
Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Read More
Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·
Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Read More
Malware User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by malware in proxy logs

Read More
Mesh Agent Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Read More
MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·
Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Read More
Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Read More
Netcat The Powershell Version

Aug 12, 2024 · attack.command-and-control attack.t1095 ·
Share on:

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Read More
Network Communication Initiated To Portmap.IO Domain

Aug 12, 2024 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·
Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Read More
Network Connection Initiated By IMEWDBLD.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

Read More
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process

Aug 12, 2024 · attack.command-and-control attack.t1102 attack.t1102.001 ·
Share on:

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Read More
Network Connection Initiated To Cloudflared Tunnels Domains

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567.001 ·
Share on:

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Network Connection Initiated Via Notepad.EXE

Aug 12, 2024 · attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·
Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Read More
New Kind of Network (NKN) Detection

Aug 12, 2024 · attack.command-and-control ·
Share on:

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

Read More
New Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Read More
New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

Read More
Ngrok Usage with Remote Desktop Service

Aug 12, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

Read More
Office Application Initiated Network Connection Over Uncommon Ports

Aug 12, 2024 · attack.defense-evasion attack.command-and-control ·
Share on:

Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.

Read More
OilRig APT Activity

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Registry Persistence

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Aug 12, 2024 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
Okta Security Threat Detected

Aug 12, 2024 · attack.command-and-control ·
Share on:

Detects when an security threat is detected in Okta.

Read More
OpenCanary - Telnet Login Attempt

Aug 12, 2024 · attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·
Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Read More
Outbound Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Read More
Outbound Network Connection To Public IP Via Winlogon

Aug 12, 2024 · attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 ·
Share on:

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Read More
Outlook Macro Execution Without Warning Setting Enabled

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Pandemic Registry Key

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects Pandemic Windows Implant

Read More
Password Protected ZIP File Opened (Suspicious Filenames)

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1027 attack.t1105 attack.t1036 ·
Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Read More
Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Potential Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Read More
Potential COM Objects Download Cradles Usage - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Read More
Potential COM Objects Download Cradles Usage - PS Script

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Read More
Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Read More
Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Read More
Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Read More
Potential Compromised 3CXDesktopApp ICO C2 File Download

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Read More
Potential CSharp Streamer RAT Loading .NET Executable Image

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

Read More
Potential CVE-2023-36884 Exploitation - File Downloads

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation - Share Access

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation - URL Marker

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Read More
Potential CVE-2023-36884 Exploitation Pattern

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Read More
Potential CVE-2303-36884 URL Request Pattern Traffic

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

Read More
Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Read More
Potential Download/Upload Activity Using Type Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Read More
Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·
Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Read More
Potential Linux Amazon SSM Agent Hijacking

Aug 12, 2024 · attack.command-and-control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Operation Triangulation C2 Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Read More
Potential Operation Triangulation C2 Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of plink to perform data exfiltration and tunneling

Read More
Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Read More
Potential Remote Desktop Connection to Non-Domain Host

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects logons using NTLM to hosts that are potentially not part of the domain.

Read More
Potential SocGholish Second Stage C2 DNS Query

Aug 12, 2024 · attack.command-and-control attack.t1219 detection.emerging-threats ·
Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Read More
Potential Suspicious Child Process Of 3CXDesktopApp

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1218 detection.emerging-threats ·
Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Read More
Potential WizardUpdate Malware Infection

Aug 12, 2024 · attack.command-and-control ·
Share on:

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Read More
Potentially Suspicious Malware Callback Communication

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

Read More
Potentially Suspicious Malware Callback Communication - Linux

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Read More
Potentially Suspicious Network Connection To Notion API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Read More
Potentially Suspicious Usage Of Qemu

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.t1572 ·
Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Read More
PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·
Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Read More
PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects suspicious ways to download files or content using PowerShell

Read More
PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Read More
PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of 3proxy, a tiny free proxy server

Read More
PUA - Chisel Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

Read More
PUA - Netcat Suspicious Execution

Aug 12, 2024 · attack.command-and-control attack.t1095 ·
Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Read More
PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

Read More
PwnDrp Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·
Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Read More
Query Tor Onion Address - DNS Client

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects DNS resolution of an .onion address related to Tor routing networks

Read More
Raw Paste Service Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 attack.defense-evasion ·
Share on:

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Read More
RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Read More
RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

Read More
RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Read More
RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Read More
Remote Access Tool - AnyDesk Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - Anydesk Execution From Suspicious Folder

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - AnyDesk Piped Password Via CLI

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Read More
Remote Access Tool - AnyDesk Silent Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Read More
Remote Access Tool - GoToAssist Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - LogMeIn Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - NetSupport Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - ScreenConnect Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Read More
Remote Access Tool - Simple Help Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - UltraViewer Execution

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote File Copy

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1105 ·
Share on:

Detects the use of tools that copy files from or to remote systems

Read More
Remote File Download Via Desktopimgdownldr Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Read More
Renamed Remote Utilities RAT (RURAT) Execution

Aug 12, 2024 · attack.defense-evasion attack.collection attack.command-and-control attack.discovery attack.s0592 ·
Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Read More
Renamed Visual Studio Code Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Replace.exe Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Read More
ScreenConnect Temporary Installation Artefact

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Sign-In From Malware Infected IP

Aug 12, 2024 · attack.t1090 attack.command-and-control ·
Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Read More
Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
Small Sieve Malware Potential C2 Communication

Aug 12, 2024 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects potential C2 communication related to Small Sieve malware

Read More
Suspicious Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Read More
Suspicious Binary Writes Via AnyDesk

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Read More
Suspicious C2 Activities

Aug 12, 2024 · attack.command-and-control ·
Share on:

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

Read More
Suspicious Certreq Command to Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Read More
Suspicious Child Process Of Manage Engine ServiceDesk

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Read More
Suspicious Cobalt Strike DNS Beaconing - DNS Client

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Cobalt Strike DNS Beaconing - Sysmon

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Curl Change User Agents - Linux

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects a suspicious curl process start on linux with set useragent options

Read More
Suspicious Curl.EXE Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Read More
Suspicious Desktopimgdownldr Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Read More
Suspicious Desktopimgdownldr Target File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Read More
Suspicious Diantz Download and Compress Into a CAB File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Download and compress a remote file and store it in a cab file on local machine.

Read More
Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries using base64 encoding

Read More
Suspicious DNS Z Flag Bit Set

Aug 12, 2024 · attack.t1095 attack.t1571 attack.command-and-control ·
Share on:

The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

Read More
Suspicious Download from Office Domain

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.t1608 ·
Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Read More
Suspicious Dropbox API Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Read More
Suspicious Extrac32 Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Download or Copy file with Extrac32

Read More
Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Read More
Suspicious FromBase64String Usage On Gzip Archive - Ps Script

Aug 12, 2024 · attack.command-and-control attack.t1132.001 ·
Share on:

Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.

Read More
Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·
Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Read More
Suspicious Invoke-WebRequest Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Read More
Suspicious Invoke-WebRequest Execution With DirectIP

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Read More
Suspicious LDAP-Attributes Used

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·
Share on:

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

Read More
Suspicious Mstsc.EXE Execution With Local RDP File

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
Suspicious Non-Browser Network Communication With Google API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)

Read More
Suspicious Non-Browser Network Communication With Telegram API

Aug 12, 2024 · attack.command-and-control attack.t1102 ·
Share on:

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Read More
Suspicious Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·
Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Read More
Suspicious SSL Connection

Aug 12, 2024 · attack.command-and-control attack.t1573 ·
Share on:

Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Read More
Suspicious TCP Tunnel Via PowerShell Script

Aug 12, 2024 · attack.command-and-control attack.t1090 ·
Share on:

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity

Read More
Suspicious TSCON Start as SYSTEM

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Read More
Suspicious User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious malformed user agent strings in proxy logs

Read More
TacticalRMM Service Installation

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Read More
TeamViewer Domain Query By Non-TeamViewer Application

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Read More
TeamViewer Remote Session

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

Detects the creation of log files during a TeamViewer remote session

Read More
Telegram API Access

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.t1102.002 ·
Share on:

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Read More
Telegram Bot API Request

Aug 12, 2024 · attack.command-and-control attack.t1102.002 ·
Share on:

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Read More
Testing Usage of Uncommonly Used Port

Aug 12, 2024 · attack.command-and-control attack.t1571 ·
Share on:

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.

Read More
Tor Client/Browser Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

Read More
Uncommon Network Connection Initiated By Certutil.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Read More
Ursnif Malware C2 URL Pattern

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1204.002 attack.command-and-control attack.t1071.001 ·
Share on:

Detects Ursnif C2 traffic.

Read More
Ursnif Malware Download URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects download of Ursnif malware done by dropper documents.

Read More
Use of UltraVNC Remote Access Software

Aug 12, 2024 · attack.command-and-control attack.t1219 ·
Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Read More
Wannacry Killswitch Domain

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects wannacry killswitch domain dns queries

Read More
Wget Creating Files in Tmp Directory

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Read More
Windows PowerShell User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects Windows PowerShell Web Access

Read More
Windows WebDAV User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects WebDav DownloadCradle

Read More