attack.command_and_control | Detection.FYI

Detect MeshAgent Command Execution via MeshCentral

Sep 21, 2024 · attack.command_and_control attack.t1219 ·
Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Read More
BITSAdmin Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·
Share on:

It is not unusual for adversaries, including ones who peddle ransomware, to use BITSAdmin to download arbitrary files from the internet in an effort to evade application blocklisting. The following analytic will look for the execution of bitsadmin.exe with command options that suggest a file is being downloaded. Part of the RedCanary 2024 Threat Detection Report.

Read More
Certreq Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·
Share on:

Just like certutil, certreq can also be abused by adversaries to download and upload data. The following analytic will look for the execution of certreq.exe with command options that suggest a file is being downloaded. Part of the RedCanary 2024 Threat Detection Report.

Read More
CertUtil Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·
Share on:

Adversaries often bypass security controls by using the Windows Certificate Utility (certutil.exe) to download malicious code. In general, they leverage certutil.exe along with the -split command-line option. Part of the RedCanary 2024 Threat Detection Report.

Read More
Network Connections from the Command Line with no Parameters

Mar 26, 2024 · attack.command_and_control ·
Share on:

It is unusual for these processes to attempt network connections with an empty command line, which can indicate malicious command and control (C2) activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Operator Bring Your Own Tools

Feb 23, 2024 · attack.command_and_control attack.t1105 ·
Share on:

Detects use of custom scripts i.e. BAT files.

Read More
SSH over port 443 with known Server and Client Strings

Feb 23, 2024 · attack.command_and_control attack.t1572 ·
Share on:

Will detect the presence of known SSH client and SSH server strings that have been used for SSH tunneling.

Read More
Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
BITSAdmin Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects attempts to bypass security controls using bitsadmin.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Read More
Certutil Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects attempts to bypass security controls using certutil.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Read More
Possible Raspberry Robin DLL Download Using msiexec (RedCanary Threat Detection Report)

May 10, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects msiexec used to download a potentially-malicious Raspberry Robin DLL. Part of the RedCanary 2023 Threat Detection Report.

Read More
DNSCat2 Powershell Implementation Detection Via Process Creation

Apr 21, 2023 · attack.command_and_control attack.t1071 attack.t1071.004 attack.t1001.003 attack.t1041 ·
Share on:

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.

Read More
High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

Read More
High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Read More
Possible DNS Rebinding

Apr 21, 2023 · attack.command_and_control attack.t1043 ·
Share on:

Detects DNS-answer with TTL <10.

Read More
Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·
Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.

Read More
Suspicious Werfault.exe Network Connection Outbound

Apr 21, 2023 · attack.command_and_control attack.t1571 ·
Share on:

Adversaries can migrate cobalt strike/metasploit/C2 beacons on compromised systems to legitimate werfault.exe process to avoid detection.

Read More
DNS Query From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects DNS queries from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Download by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects downloads by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
File Creation by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects file creations by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Network Connection From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects network connections from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
AnyDesk Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·
Share on:

Detects use of AnyDesk

Read More
SplashTop Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·
Share on:

Detects use of SplashTop

Read More
SplashTop Process

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·
Share on:

Detects use of SplashTop

Read More
Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Executable Deployment from Remote Share

Nov 29, 2022 · attack.lateral_movement attack.command_and_control attack.t1105 attack.t1021 ·
Share on:

Detects use of the copy utility to deploy executable files from a remote share to a temp directory, such as the procedure performed by Vice Ransomware gang.

Read More
BITSAdmin Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·
Share on:

Detects usage of BITSAdmin to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

Read More
CertUtil Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·
Share on:

Detects usage of certutil to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

Read More