attack.command_and_control

Malicious IP Address Sign-In Failure Rate

Sep 11, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Sep 11, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Potential Dead Drop Resolvers

Sep 8, 2023 · attack.command_and_control attack.t1102 attack.t1102.001 ·

Share on:

Detects an executable, which is not an internet browser, making DNS request to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.

Suspicious Child Process Of Manage Engine ServiceDesk

Sep 7, 2023 · attack.command_and_control attack.t1102 ·

Share on:

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Sign-In From Malware Infected IP

Sep 6, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

New Port Forwarding Rule Added Via Netsh.EXE

Sep 1, 2023 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Abusing IEExec To Download Payloads

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download payloads

Gzip Archive Decode Via PowerShell

Aug 28, 2023 · attack.command_and_control attack.t1132.001 ·

Share on:

Detects attempts of decoding encoded Gzip archives via PowerShell.

Password Protected ZIP File Opened (Suspicious Filenames)

Aug 28, 2023 · attack.command_and_control attack.defense_evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Potential COM Objects Download Cradles Usage - Process Creation

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential COM Objects Download Cradles Usage - PS Script

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 28, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

PowerShell Web Download

Aug 28, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

Suspicious Download from Office Domain

Aug 28, 2023 · attack.command_and_control attack.t1105 attack.t1608 ·

Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Suspicious Dropbox API Usage

Aug 28, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Suspicious FromBase64String Usage On Gzip Archive - Process Creation

Aug 28, 2023 · attack.command_and_control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Suspicious FromBase64String Usage On Gzip Archive - Ps Script

Aug 28, 2023 · attack.command_and_control attack.t1132.001 ·

Share on:

Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.

Devil Bait Potential C2 Communication Traffic

Aug 23, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Devil Bait malware

Potential In-Memory Download And Compile Of Payloads

Aug 22, 2023 · attack.command_and_control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Outlook Macro Execution Without Warning Setting Enabled

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Potential Linux Amazon SSM Agent Hijacking

Aug 3, 2023 · attack.command_and_control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research reoport.

Potential Amazon SSM Agent Hijacking

Aug 3, 2023 · attack.command_and_control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research reoport.

Malware User Agent

Jul 17, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by malware in proxy logs

Suspicious Office Outbound Connections

Jul 17, 2023 · attack.defense_evasion attack.command_and_control ·

Share on:

Detects office suit applications communicating to target systems on uncommon ports

Potential CVE-2023-36884 Exploitation - Share Access

Jul 17, 2023 · attack.command_and_control cve.2023.36884 ·

Share on:

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

Potential CVE-2023-36884 Exploitation - URL Marker

Jul 17, 2023 · attack.command_and_control cve.2023.36884 ·

Share on:

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Potential CVE-2023-36884 Exploitation Pattern

Jul 17, 2023 · attack.command_and_control cve.2023.36884 ·

Share on:

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Potential CVE-2303-36884 URL Request Pattern Traffic

Jul 17, 2023 · attack.command_and_control cve.2023.36884 ·

Share on:

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

Potential CVE-2023-36884 Exploitation - File Downloads

Jul 13, 2023 · attack.command_and_control cve.2023.36884 ·

Share on:

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Wannacry Killswitch Domain

Jun 26, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects wannacry killswitch domain dns queries

GfxDownloadWrapper.exe Downloads File from Suspicious URL

Jun 26, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects when GfxDownloadWrapper.exe downloads file from non standard URL

Suspicious Curl.EXE Download

Jun 22, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

GALLIUM IOCs

Jun 20, 2023 · attack.credential_access attack.command_and_control attack.t1212 attack.t1071 attack.g0093 detection.emerging_threats ·

Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Goofy Guineapig Backdoor Potential C2 Communication

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Goofy Guineapig backdoor

Greenbug Espionage Group Indicators

Jun 20, 2023 · attack.g0049 attack.execution attack.t1059.001 attack.command_and_control attack.t1105 attack.defense_evasion attack.t1036.005 detection.emerging_threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

OilRig APT Activity

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·

Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

OilRig APT Schedule Task Persistence - Security

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·

Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

OilRig APT Schedule Task Persistence - System

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·

Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp ICO C2 File Download

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Potential Operation Triangulation C2 Beaconing Activity - DNS

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Potential Operation Triangulation C2 Beaconing Activity - Proxy

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Potential Suspicious Child Process Of 3CXDesktopApp

Jun 20, 2023 · attack.command_and_control attack.execution attack.t1218 detection.emerging_threats ·

Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Small Sieve Malware Potential C2 Communication

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Small Sieve malware

DNS Query To Remote Access Software Domain

Jun 15, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Download File To Potentially Suspicious Directory Via Wget

Jun 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of wget to download content to a suspicious directory

Wget Creating Files in Tmp Directory

Jun 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Suspicious Non-Browser Network Communication With Telegram API

May 19, 2023 · attack.command_and_control attack.t1102 ·

Share on:

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

APT40 Dropbox Tool User Agent

May 18, 2023 · attack.command_and_control attack.t1071.001 attack.exfiltration attack.t1567.002 ·

Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Download from Suspicious Dyndns Hosts

May 18, 2023 · attack.defense_evasion attack.command_and_control attack.t1105 attack.t1568 ·

Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Telegram API Access

May 18, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 attack.t1102.002 ·

Share on:

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Cloudflared Tunnel Connections Cleanup

May 17, 2023 · attack.command_and_control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

May 17, 2023 · attack.command_and_control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

BITSAdmin Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using bitsadmin.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Certutil Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using certutil.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Bitsadmin to Uncommon TLD

May 17, 2023 · attack.command_and_control attack.t1071.001 attack.defense_evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

File Download with Headless Browser

May 15, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

ScreenConnect Temporary Installation Artefact

May 15, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Possible Raspberry Robin DLL Download Using msiexec (RedCanary Threat Detection Report)

May 10, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects msiexec used to download a potentially-malicious Raspberry Robin DLL. Part of the RedCanary 2023 Threat Detection Report.

Potentially Suspicious Network Connection To Notion API

May 9, 2023 · attack.command_and_control attack.t1102 ·

Share on:

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Potential Base64 Encoded User-Agent

May 9, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Suspicious Base64 Encoded User-Agent

May 4, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Suspicious Non-Browser Network Communication With Google API

May 3, 2023 · attack.command_and_control attack.t1102 ·

Share on:

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)

Suspicious Typical Malware Back Connect Ports

May 2, 2023 · attack.persistence attack.command_and_control attack.t1571 ·

Share on:

Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases

Mstsc.EXE Execution With Local RDP File

Apr 30, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Suspicious Mstsc.EXE Execution With Local RDP File

Apr 30, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Outbound Network Connection To Public IP Via Winlogon

Apr 28, 2023 · attack.defense_evasion attack.execution attack.command_and_control attack.t1218.011 ·

Share on:

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Suspicious Invoke-WebRequest Execution With DirectIP

Apr 24, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Suspicious Invoke-WebRequest Execution

Apr 21, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

DNSCat2 Powershell Implementation Detection Via Process Creation

Apr 21, 2023 · attack.command_and_control attack.t1071 attack.t1071.004 attack.t1001.003 attack.t1041 ·

Share on:

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.

High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

High DNS requests amount from host per short period of time

High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

High DNS requests amount from host per short period of time

High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Possible DNS Rebinding

Apr 21, 2023 · attack.command_and_control attack.t1043 ·

Share on:

Detects DNS-answer with TTL <10.

Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·

Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.

Suspicious Werfault.exe Network Connection Outbound

Apr 21, 2023 · attack.command_and_control attack.t1571 ·

Share on:

Adversaries can migrate cobalt strike/metasploit/C2 beacons on compromised systems to legitimate werfault.exe process to avoid detection.

Suspicious Non-Browser Network Communication With Reddit API

Apr 19, 2023 · attack.command_and_control attack.t1102 ·

Share on:

Detects an a non-browser process interacting with the Reddit API which could indicate use of a covert C2 such as RedditC2

Connection Initiated Via Certutil.EXE

Apr 18, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a network connection initiated by the certutil.exe tool. Attackers can abuse the utility in order to download malware or additional payloads.

Mesh Agent Service Installation

Apr 14, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

TacticalRMM Service Installation

Apr 14, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Potential Arbitrary File Download Via MSEdge.EXE

Apr 14, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of the "msedge.exe" binary as a LOLBIN to download arbitrary file via the CLI

Silence.EDA Detection

Apr 11, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·

Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Import LDAP Data Interchange Format File Via Ldifde.EXE

Mar 15, 2023 · attack.command_and_control attack.defense_evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

OilRig APT Registry Persistence

Mar 9, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 ·

Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Use of UltraViewer Remote Access Software

Mar 9, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Command Line Execution with Suspicious URL and AppData Strings

Mar 7, 2023 · attack.execution attack.command_and_control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Curl Download And Execute Combination

Mar 7, 2023 · attack.execution attack.t1218 attack.command_and_control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Remote Access Tool - Anydesk Execution From Suspicious Folder

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Piped Password Via CLI

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Remote Access Tool - AnyDesk Silent Installation

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Remote Access Tool - GoToAssist Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - LogMeIn Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - NetSupport Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Backstage Mode Anomaly

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects suspicious sub processes started by the ScreenConnect client service, which indicates the use of the so-called Backstage mode

Remote Access Tool - ScreenConnect Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote File Download via Desktopimgdownldr Utility

Mar 5, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Suspicious Desktopimgdownldr Command

Mar 5, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Suspicious TSCON Start as SYSTEM

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Tor Client/Browser Execution

Mar 5, 2023 · attack.command_and_control attack.t1090.003 ·

Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

File Download Using Notepad++ GUP Utility

Mar 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

Windows Update Client LOLBIN

Mar 2, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1218 ·

Share on:

Detects code execution via the Windows Update client (wuauclt)

Potential SocGholish Second Stage C2 DNS Query

Feb 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Suspicious Installer Package Child Process

Feb 21, 2023 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command_and_control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

DNS Exfiltration and Tunneling Tools Execution

Feb 21, 2023 · attack.exfiltration attack.t1048.001 attack.command_and_control attack.t1071.004 attack.t1132.001 ·

Share on:

Well-known DNS Exfiltration tools execution

Finger.exe Suspicious Invocation

Feb 21, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays

MsiExec Web Install

Feb 21, 2023 · attack.defense_evasion attack.t1218.007 attack.command_and_control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

PowerShell DownloadFile

Feb 21, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1104 attack.t1105 ·

Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

PUA - 3Proxy Execution

Feb 21, 2023 · attack.command_and_control attack.t1572 ·

Share on:

Detects the use of 3proxy, a tiny free proxy server

PUA - Ngrok Execution

Feb 21, 2023 · attack.command_and_control attack.t1572 ·

Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

Suspicious Binary Writes Via AnyDesk

Feb 20, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

HackTool - SILENTTRINITY Stager DLL Load

Feb 17, 2023 · attack.command_and_control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager dll loading activity

HackTool - SILENTTRINITY Stager Execution

Feb 17, 2023 · attack.command_and_control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager use via PE metadata

Inveigh Execution Artefacts

Feb 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects the presence and execution of Inveigh via dropped artefacts

RDP Port Forwarding Rule Added Via Netsh.EXE

Feb 16, 2023 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

HackTool - SharpChisel Execution

Feb 13, 2023 · attack.command_and_control attack.t1090.001 ·

Share on:

Detects usage of the Sharp Chisel via the commandline arguments

PUA - Chisel Tunneling Tool Execution

Feb 13, 2023 · attack.command_and_control attack.t1090.001 ·

Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

PUA - Nimgrab Execution

Feb 13, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

PUA - Netcat Suspicious Execution

Feb 8, 2023 · attack.command_and_control attack.t1095 ·

Share on:

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

PUA- IOX Tunneling Tool Execution

Feb 8, 2023 · attack.command_and_control attack.t1090 ·

Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

New Outlook Macro Created

Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

Suspicious Outlook Macro Created

Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

PUA - NPS Tunneling Tool Execution

Feb 6, 2023 · attack.command_and_control attack.t1090 ·

Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

Potential RDP Tunneling Via SSH Plink

Feb 5, 2023 · attack.command_and_control attack.t1572 ·

Share on:

Execution of plink to perform data exfiltration and tunneling

Suspicious Plink Port Forwarding

Feb 5, 2023 · attack.command_and_control attack.t1572 attack.lateral_movement attack.t1021.001 ·

Share on:

Detects suspicious Plink tunnel port forwarding to a local port

HackTool - Htran/NATBypass Execution

Feb 4, 2023 · attack.command_and_control attack.t1090 attack.s0040 ·

Share on:

Detects exeuctable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

PUA - Fast Reverse Proxy (FRP) Execution

Feb 4, 2023 · attack.command_and_control attack.t1090 ·

Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

Port Forwarding Attempt Via SSH

Feb 3, 2023 · attack.command_and_control attack.lateral_movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects suspicious SSH tunnel port forwarding to a local port

Renamed Remote Utilities RAT (RURAT) Execution

Feb 3, 2023 · attack.defense_evasion attack.collection attack.command_and_control attack.discovery attack.s0592 ·

Share on:

Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Antivirus Exploitation Framework Detection

Feb 1, 2023 · attack.execution attack.t1203 attack.command_and_control attack.t1219 ·

Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework

APT User Agent

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

BabyShark Agent Pattern

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects Baby Shark C2 Framework communication patterns

Bitsadmin to Uncommon IP Server Address

Feb 1, 2023 · attack.command_and_control attack.t1071.001 attack.defense_evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Chafer Malware URL Pattern

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects HTTP requests used by Chafer malware

Cobalt Strike DNS Beaconing

Feb 1, 2023 · attack.command_and_control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

CobaltStrike Malformed UAs in Malleable Profiles

Feb 1, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects different malformed user agents used in Malleable Profiles used with Cobalt Strike

Communication To Ngrok Tunneling Service

Feb 1, 2023 · attack.exfiltration attack.command_and_control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service - Linux

Feb 1, 2023 · attack.exfiltration attack.command_and_control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Crypto Miner User Agent

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Curl Usage on Linux

Feb 1, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Empire UserAgent URI Combo

Feb 1, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects user agent and URI paths used by empire agents

Empty User Agent

Feb 1, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious empty user agent strings in proxy logs

Equation Group C2 Communication

Feb 1, 2023 · attack.command_and_control attack.g0020 attack.t1041 ·

Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Exploit Framework User Agent

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Ngrok Usage with Remote Desktop Service

Feb 1, 2023 · attack.command_and_control attack.t1090 ·

Share on:

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

Potential Download/Upload Activity Using Type Command

Feb 1, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Potential RDP Tunneling Via SSH

Feb 1, 2023 · attack.command_and_control attack.t1572 ·

Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

PwnDrp Access

Feb 1, 2023 · attack.command_and_control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·

Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Query Tor Onion Address - DNS Client

Feb 1, 2023 · attack.command_and_control attack.t1090.003 ·

Share on:

Detects DNS resolution of an .onion address related to Tor routing networks

Raw Paste Service Access

Feb 1, 2023 · attack.command_and_control attack.t1071.001 attack.t1102.001 attack.t1102.003 attack.defense_evasion ·

Share on:

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

RDP to HTTP or HTTPS Target Ports

Feb 1, 2023 · attack.command_and_control attack.t1572 attack.lateral_movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Suspicious C2 Activities

Feb 1, 2023 · attack.command_and_control ·

Share on:

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

Suspicious Certreq Command to Download

Feb 1, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Suspicious Cobalt Strike DNS Beaconing - DNS Client

Feb 1, 2023 · attack.command_and_control attack.t1071.004 ·

Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Suspicious Cobalt Strike DNS Beaconing - Sysmon

Feb 1, 2023 · attack.command_and_control attack.t1071.004 ·

Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Suspicious Curl Change User Agents - Linux

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects a suspicious curl process start on linux with set useragent options

Suspicious DNS Query with B64 Encoded String

Feb 1, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries using base64 encoding

Suspicious File Download via CertOC.exe

Feb 1, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects when a user downloads file by using CertOC.exe

Suspicious Program Location with Network Connections

Feb 1, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects programs with network connections running in suspicious files system locations

Suspicious TCP Tunnel Via PowerShell Script

Feb 1, 2023 · attack.command_and_control attack.t1090 ·

Share on:

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity

Suspicious TeamViewer Domain Access

Feb 1, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Suspicious User Agent

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects suspicious malformed user agent strings in proxy logs

TeamViewer Remote Session

Feb 1, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects the creation of log files during a TeamViewer remote session

Telegram Bot API Request

Feb 1, 2023 · attack.command_and_control attack.t1102.002 ·

Share on:

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Turla ComRAT

Feb 1, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 attack.g0010 ·

Share on:

Detects Turla ComRAT patterns

Windows PowerShell User Agent

Feb 1, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects Windows PowerShell Web Access

Windows WebDAV User Agent

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects WebDav DownloadCradle

CobaltStrike Malleable (OCSP) Profile

Jan 31, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects Malleable (OCSP) Profile with Typo (OSCP) in URL

CobaltStrike Malleable Amazon Browsing Traffic Profile

Jan 31, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects Malleable Amazon Profile

CobaltStrike Malleable OneDrive Browsing Traffic Profile

Jan 31, 2023 · attack.defense_evasion attack.command_and_control attack.t1071.001 ·

Share on:

Detects Malleable OneDrive Profile

Ursnif Malware C2 URL Pattern

Jan 31, 2023 · attack.initial_access attack.t1566.001 attack.execution attack.t1204.002 attack.command_and_control attack.t1071.001 ·

Share on:

Detects Ursnif C2 traffic.

Ursnif Malware Download URL Pattern

Jan 31, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects download of Ursnif malware done by dropper documents.

DNS Query From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects DNS queries from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Download by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects downloads by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

File Creation by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects file creations by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Network Connection From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects network connections from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Anydesk Temporary Artefact

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Download a File with IMEWDBLD.exe

Jan 27, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Use IMEWDBLD.exe (built-in to windows) to download a file

GoToAssist Temporary Installation Artefact

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Installation of TeamViewer Desktop

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

TeamViewer_Desktop.exe is create during install

Suspicious SSL Connection

Jan 27, 2023 · attack.command_and_control attack.t1573 ·

Share on:

Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Testing Usage of Uncommonly Used Port

Jan 27, 2023 · attack.command_and_control attack.t1571 ·

Share on:

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.

DNS Query Tor Onion Address - Sysmon

Jan 17, 2023 · attack.command_and_control attack.t1090.003 ·

Share on:

Detects DNS queries to an ".onion" address related to Tor routing networks

Suspicious ADSI-Cache Usage By Unknown Tool

Jan 17, 2023 · attack.t1001.003 attack.command_and_control ·

Share on:

Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger.

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

AppX Package Installation Attempts Via AppInstaller

Jan 12, 2023 · attack.command_and_control attack.t1105 ·

Share on:

AppInstaller.exe is spawned by the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

AnyDesk Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·

Share on:

Detects use of AnyDesk

Operator Bring Your Own Tools

Jan 8, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects use of custom scripts i.e. BAT files.

SplashTop Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·

Share on:

Detects use of SplashTop

SplashTop Process

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·

Share on:

Detects use of SplashTop

Cisco Stage Data

Jan 4, 2023 · attack.collection attack.lateral_movement attack.command_and_control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Change User Agents with WebRequest

Jan 4, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

GALLIUM Artefacts - Builtin

Jan 2, 2023 · attack.credential_access attack.command_and_control attack.t1071 ·

Share on:

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Netcat The Powershell Version

Dec 27, 2022 · attack.command_and_control attack.t1095 ·

Share on:

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

RDP Over Reverse SSH Tunnel

Dec 8, 2022 · attack.command_and_control attack.t1572 attack.lateral_movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious DNS Z Flag Bit Set

Nov 29, 2022 · attack.t1095 attack.t1571 attack.command_and_control ·

Share on:

The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

Executable Deployment from Remote Share

Nov 29, 2022 · attack.lateral_movement attack.command_and_control attack.t1105 attack.t1021 ·

Share on:

Detects use of the copy utility to deploy executable files from a remote share to a temp directory, such as the procedure performed by Vice Ransomware gang.

BITSAdmin Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of BITSAdmin to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

CertUtil Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of certutil to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

Exfiltration and Tunneling Tools Execution

Oct 28, 2022 · attack.exfiltration attack.command_and_control attack.t1041 attack.t1572 attack.t1071.001 ·

Share on:

Execution of well known tools for data exfiltration and tunneling

PrintBrm ZIP Creation of Extraction

Oct 28, 2022 · attack.command_and_control attack.t1105 attack.defense_evasion attack.t1564.004 ·

Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Replace.exe Usage

Oct 28, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Suspicious Diantz Download and Compress Into a CAB File

Oct 28, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Download and compress a remote file and store it in a cab file on local machine.

Suspicious Extrac32 Execution

Oct 28, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Download or Copy file with Extrac32

Use of UltraVNC Remote Access Software

Oct 28, 2022 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Windows Defender Download Activity

Oct 28, 2022 · attack.defense_evasion attack.t1218 attack.command_and_control attack.t1105 ·

Share on:

Detect the use of Windows Defender to download payloads

Potential WizardUpdate Malware Infection

Oct 28, 2022 · attack.command_and_control ·

Share on:

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Notepad Making Network Connection

Oct 26, 2022 · attack.command_and_control attack.execution attack.defense_evasion attack.t1055 ·

Share on:

Detects suspicious network connection by Notepad

Script Initiated Connection

Oct 26, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects a script interpreter wscript/cscript opening a network connection. Adversaries may use script to download malicious payloads.

Script Initiated Connection to Non-Local Network

Oct 26, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Hijack Legit RDP Session to Move Laterally

Oct 26, 2022 · attack.command_and_control attack.t1219 ·

Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Potential Remote Desktop Connection to Non-Domain Host

Oct 25, 2022 · attack.command_and_control attack.t1219 ·

Share on:

Detects logons using NTLM to hosts that are potentially not part of the domain.

Suspicious LDAP-Attributes Used

Oct 25, 2022 · attack.t1001.003 attack.command_and_control ·

Share on:

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

Default Cobalt Strike Certificate

Oct 25, 2022 · attack.command_and_control attack.s0154 ·

Share on:

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

DNS TXT Answer with Possible Execution Strings

Oct 25, 2022 · attack.command_and_control attack.t1071.004 ·

Share on:

Detects strings used in command execution in DNS TXT Answer

Executable from Webdav

Oct 25, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

New Kind of Network (NKN) Detection

Oct 25, 2022 · attack.command_and_control ·

Share on:

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

Remote File Copy

Oct 25, 2022 · attack.command_and_control attack.lateral_movement attack.t1105 ·

Share on:

Detects the use of tools that copy files from or to remote systems

Activity from Suspicious IP Addresses

Oct 25, 2022 · attack.command_and_control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

RDP over Reverse SSH Tunnel WFP

Oct 14, 2022 · attack.defense_evasion attack.command_and_control attack.lateral_movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

Activity from Anonymous IP Addresses

Oct 9, 2022 · attack.command_and_control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Activity from Infrequent Country

Oct 9, 2022 · attack.command_and_control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

PortProxy Registry Key

Oct 9, 2022 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the modification of PortProxy registry key which is used for port forwarding. For command execution see rule win_netsh_port_fwd.yml.