attack.defense-evasion

Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Dec 19, 2024 · attack.defense-evasion attack.t1055 ·

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

Potential Secure Deletion with SDelete

Dec 14, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·

Share on:

Detects files that have extensions commonly seen while SDelete is used to wipe files.

NetNTLM Downgrade Attack - Registry

Dec 3, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·

Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·

Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·

Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

All Rules Have Been Deleted From The Windows Firewall Configuration

Dec 1, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

GCP Break-glass Container Workload Deployed

Dec 1, 2024 · attack.defense-evasion attack.t1548 ·

Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

HackTool - EDRSilencer Execution - Filter Added

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Dec 1, 2024 · detection.emerging-threats attack.defense-evasion attack.execution ·

Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Potential Pikabot Hollowing Activity

Dec 1, 2024 · attack.defense-evasion attack.t1055.012 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Potentially Suspicious Self Extraction Directive File Created

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.

Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Self Extraction Directive File Created In Potentially Suspicious Location

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.

System Control Panel Item Loaded From Uncommon Location

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Creation of WerFault.exe/Wer.dll in Unusual Folder

Nov 29, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution GMER tool based on image and hash fields.

HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·

Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·

Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

HackTool - SharpEvtMute DLL Load

Nov 25, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·

Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

HackTool Named File Stream Created

Nov 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Malicious DLL Load By Compromised 3CXDesktopApp

Nov 25, 2024 · attack.defense-evasion detection.emerging-threats ·

Share on:

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Potential Compromised 3CXDesktopApp Execution

Nov 25, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·

Share on:

Detects execution of known compromised version of 3CXDesktopApp

Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·

Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of renamed version of PAExec. Often used by attackers

WinDivert Driver Load

Nov 25, 2024 · attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·

Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

ESXi Syslog Configuration Change Via ESXCLI

Nov 20, 2024 · attack.defense-evasion attack.t1562.001 attack.t1562.003 ·

Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·

Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

.RDP File Created by Outlook Process

Nov 4, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use RDP files as attachments.

.RDP File Created By Uncommon Application

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

DLL Names Used By SVR For GraphicalProton Backdoor

Nov 1, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Hunts known SVR-specific DLL names.

Enable LM Hash Storage

Nov 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Potential Base64 Decoded From Images

Nov 1, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Potential PowerShell Execution Policy Tampering

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Potentially Suspicious Desktop Background Change Via Registry

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·

Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

PSScriptPolicyTest Creation By Uncommon Process

Nov 1, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·

Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·

Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

System Information Discovery Using System_Profiler

Nov 1, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·

Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Tamper Windows Defender - PSClassic

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Tamper Windows Defender - ScriptBlockLogging

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

BITS Transfer Job Download From File Sharing Domains

Oct 25, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Suspicious File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Suspicious Windows Service Tampering

Oct 25, 2024 · attack.defense-evasion attack.t1489 ·

Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Unusual File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Disable Windows Defender Functionalities Via Registry Keys

Oct 8, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Potential Python DLL SideLoading

Oct 6, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of Python DLL files.

ETW Logging/Processing Option Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·

Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

HTTP Logging Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·

Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

New Module Module Added To IIS Server

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·

Share on:

Detects the addition of a new module to an IIS server.

Previously Installed IIS Module Was Removed

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·

Share on:

Detects the removal of a previously installed IIS module.

Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new potentially suspicious download sources

Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Disable Internal Tools or Feature in Registry

Oct 1, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Elevated System Shell Spawned From Uncommon Parent Location

Oct 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·

Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·

Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Important Windows Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·

Share on:

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Load Of RstrtMgr.DLL By A Suspicious Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Load Of RstrtMgr.DLL By An Uncommon Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Potential Linux Process Code Injection Via DD Utility

Oct 1, 2024 · attack.defense-evasion attack.t1055.009 ·

Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·

Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Remote Thread Creation Via PowerShell In Uncommon Target

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 ·

Share on:

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Suspicious Path In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Uncommon Extension In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Windows Defender Exclusion Registry Key - Write Access Requested

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

Windows Defender Real-time Protection Disabled

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·

Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·

Share on:

Detect DLL Load from Spooler Service backup folder

Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·

Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·

Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·

Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Process Deletion of Its Own Executable

Sep 3, 2024 · attack.defense-evasion ·

Share on:

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Diamond Sleet APT DLL Sideloading Indicators

Sep 2, 2024 · attack.defense-evasion attack.t1574.002 detection.emerging-threats ·

Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Diamond Sleet APT Scheduled Task Creation - Registry

Sep 2, 2024 · attack.defense-evasion attack.t1562 detection.emerging-threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Injected Browser Process Spawning Rundll32 - GuLoader Activity

Sep 2, 2024 · attack.defense-evasion attack.t1055 detection.emerging-threats ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Obfuscated PowerShell OneLiner Execution

Sep 2, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·

Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Sep 2, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Potentially Suspicious Office Document Executed From Trusted Location

Sep 2, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Python Function Execution Security Warning Disabled In Excel

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Suspicious LNK Double Extension File Created

Sep 2, 2024 · attack.defense-evasion attack.t1036.007 ·

Share on:

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

A Rule Has Been Deleted From The Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Uncommon AppX Package Locations

Aug 29, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is located in uncommon locations

Uncommon New Firewall Rule Added In Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects when a rule has been added to the Windows Firewall exception list

Antivirus Filter Driver Disallowed On Dev Drive - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

Hiding User Account Via SpecialAccounts Registry Key

Aug 29, 2024 · attack.defense-evasion attack.t1564.002 ·

Share on:

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Potential AMSI Bypass Via .NET Reflection

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Python Function Execution Security Warning Disabled In Excel - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

RestrictedAdminMode Registry Value Tampering

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

RestrictedAdminMode Registry Value Tampering - ProcCreation

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·

Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Aug 29, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

COM Object Execution via Xwizard.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

New Capture Session Launched Via DXCap.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Potential DLL Sideloading Using Coregen.exe

Aug 29, 2024 · attack.defense-evasion attack.t1218 attack.t1055 ·

Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Program Executed Using Proxy/Local Command Via SSH.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·

Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Xwizard.EXE Execution From Non-Default Location

Aug 29, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 23, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 23, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Suspicious Remote AppX Package Locations

Aug 23, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package added to the pipeline of the "to be processed" packages which was downloaded from a suspicious domain.

Driver Added To Disallowed Images In HVCI - Registry

Aug 21, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 16, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Powershell Token Obfuscation - Powershell

Aug 13, 2024 · attack.defense-evasion attack.t1027.009 ·

Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Abusing Print Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Attackers can use print.exe for remote file copy

Account Created And Deleted Within A Close Time Frame

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when an account was created and deleted in a short period of time.

Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Activate Suppression of Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

AD Object WriteDAC Access

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·

Share on:

Detects WRITE_DAC access to a domain object

Add DisallowRun Execution to Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new additional download sources

Add or Remove Computer from DC

Aug 12, 2024 · attack.defense-evasion attack.t1207 ·

Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Add SafeBoot Keys Via Reg Utility

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

AddinUtil.EXE Execution From Uncommon Directory

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

ADS Zone.Identifier Deleted By Uncommon Application

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Allow RDP Remote Assistance Feature

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

AMSI Bypass Pattern Assembly GetType

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.execution ·

Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Amsi.DLL Loaded Via LOLBIN Process

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

APT27 - Emissary Panda Activity

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.g0027 detection.emerging-threats ·

Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

APT29 2018 Phishing Campaign CommandLine Indicators

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

APT29 2018 Phishing Campaign File Indicators

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·

Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·

Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

AspNetCompiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Atbroker Registry Change

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·

Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Audit Policy Tampering Via Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Audit Policy Tampering Via NT Resource Kit Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Auditing Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·

Share on:

Detect changes in auditd configuration files

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·

Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

AWS CloudTrail Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling, deleting and updating of a Trail

AWS Config Disabling Channel/Recorder

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects AWS Config Service disabling

AWS GuardDuty Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

AWS SecurityHub Findings Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects the modification of the findings on SecurityHub.

Azure Active Directory Hybrid Health AD FS New Server

Aug 12, 2024 · attack.defense-evasion attack.t1578 ·

Share on:

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Azure Active Directory Hybrid Health AD FS Service Delete

Aug 12, 2024 · attack.defense-evasion attack.t1578.003 ·

Share on:

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Azure Application Deleted

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1489 ·

Share on:

Identifies when a application is deleted in Azure.

Azure Firewall Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·

Share on:

Identifies when a firewall is created, modified, or deleted.

Azure Firewall Rule Collection Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·

Share on:

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Azure Kubernetes Events Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Azure Network Firewall Policy Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.007 ·

Share on:

Identifies when a Firewall Policy is Modified or Deleted.

Azure Owner Removed From Application or Service Principal

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Identifies when a owner is was removed from a application or service principal in Azure.

Azure Service Principal Created

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Identifies when a service principal is created in Azure.

Azure Service Principal Removed

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Identifies when a service principal was removed in Azure.

Backup Catalog Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects backup catalog deletions

Base64 Encoded PowerShell Command Detected

Aug 12, 2024 · attack.t1027 attack.defense-evasion attack.t1140 attack.t1059.001 ·

Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Binary Padding - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·

Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Binary Padding - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·

Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Bitbucket Audit Log Configuration Updated

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the bitbucket audit log configuration.

Bitbucket Global Secret Scanning Rule Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects Bitbucket global secret scanning rule deletion activity.

Bitbucket Global SSH Settings Changed

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·

Share on:

Detects Bitbucket global SSH access configuration changes.

Bitbucket Project Secret Scanning Allowlist Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a secret scanning allowlist rule is added for projects.

Bitbucket Secret Scanning Exempt Repository Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a repository is exempted from secret scanning feature.

Bitbucket Secret Scanning Rule Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when secret scanning rule is deleted for the project or repository.

Bitbucket User Login Failure

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Bitlocker Key Retrieval

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for Bitlocker key retrieval.

BitLockerTogo.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

BITS Transfer Job Download From Direct IP

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

BITS Transfer Job Download To Potential Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

BITS Transfer Job Downloading File Potential Suspicious Extension

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·

Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Blackbyte Ransomware Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption

Bpfdoor TCP Ports Redirect

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Bypasses User Account Control using a fileless method

Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·

Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

C# IL Code Compilation Via Ilasm.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·

Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

CA Policy Removed by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

CA Policy Updated by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Certificate Exported Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Change the Fax Dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect possible persistence using Fax DLL load when service restart

Change to Authentication Method

Aug 12, 2024 · attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·

Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Change User Account Associated with the FAX Service

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Change Winevt Channel Access Permission Via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Changes to Device Registration Policy

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484 ·

Share on:

Monitor and alert for changes to the device registration policy.

Chmod Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·

Share on:

Detects chmod targeting files in abnormal directory paths.

Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Cisco Clear Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·

Share on:

Clear command history in network OS which is used for defense evasion

Cisco Crypto Commands

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1553.004 attack.t1552.004 ·

Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Cisco Disabling Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Turn off logging locally or remote

Cisco Duo Successful MFA Authentication Via Bypass Code

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.initial-access ·

Share on:

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Cisco File Deletion

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·

Share on:

See what files are being deleted from flash file systems

Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Clear Linux Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion

Clearing Windows Console History

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1070.003 ·

Share on:

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

ClickOnce Trust Prompt Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

CMSTP Execution Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

CobaltStrike Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe as used by CobaltStrike

CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·

Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Code Execution via Pcwutl.dll

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

COLDSTEEL Persistence Service Creation

Aug 12, 2024 · attack.defense-evasion attack.persistence detection.emerging-threats ·

Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

COLDSTEEL RAT Anonymous User Process Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

COLDSTEEL RAT Cleanup Command Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

COLDSTEEL RAT Service Persistence Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Commands to Clear or Remove the Syslog

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks

ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·

Share on:

Detects Turla ComRAT network communication.

Connection Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1090 ·

Share on:

Detects setting proxy configuration

Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·

Share on:

Detects the malicious use of a control panel item

ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Created Files by Microsoft Sync Center

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·

Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

CreateDump Process Dump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Creation Of a Suspicious ADS File Outside a Browser Download

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

Creation Of Non-Existent System DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·

Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Custom File Open Handler Executes PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects the abuse of custom file open handler, executing powershell

CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Aug 12, 2024 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 ·

Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Decode Base64 Encoded Text

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Decode Base64 Encoded Text -MacOs

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Deployment AppX Package Was Blocked By AppLocker

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package deployment that was blocked by AppLocker policy

Deployment Of The AppX Package Was Blocked By The Policy

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects an appx package deployment that was blocked by the local computer policy

Detect Virtualbox Driver Installation OR Starting Of VMs

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 attack.t1564 ·

Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Device Registration or Join Without MFA

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for device registration or join events where MFA was not performed.

DeviceCredentialDeployment Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view

Devtoolslauncher.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

The Devtoolslauncher.exe executes other binary

DHCP Callout DLL Installation

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·

Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

DHCP Server Error Failed Loading the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

DHCP Server Loaded the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 cve.2022-30190 ·

Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

Directory Removal Via Rmdir

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Disable Administrative Share Creation at Startup

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·

Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Disable Exploit Guard Network Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Disable Macro Runtime Scan Scope

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Disable Microsoft Defender Firewall via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Disable of ETW Trace - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·

Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Disable Or Stop Services

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services

Disable Powershell Command History

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·

Share on:

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Disable Privacy Settings Experience in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects registry modifications that disable Privacy Settings Experience

Disable PUA Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender PUA protection

Disable Security Events Logging Adding Reg Key MiniNt

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.

Disable Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling security tools

Disable System Firewall

Aug 12, 2024 · attack.t1562.004 attack.defense-evasion ·

Share on:

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Disable Tamper Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling Windows Defender Tamper Protection

Disable Windows Defender AV Security Monitoring

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Disable Windows Event Logging Via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Disable Windows Firewall by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detect set EnableFirewall to 0 to disable the Windows firewall

Disable Windows IIS HTTP Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Disable Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Disable-WindowsOptionalFeature Command PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Disabled IE Security Features

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Disabled Volume Snapshots

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects commands that temporarily turn off Volume Snapshots

Disabled Windows Defender Eventlog

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Disabling Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects disabling security tools

Disabling Security Tools - Builtin

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects disabling security tools

Diskshadow Script Mode - Uncommon Script Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Displaying Hidden Files Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

DLL Execution via Rasautou.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

DLL Execution Via Register-cimprovider.exe

Aug 12, 2024 · attack.defense-evasion attack.t1574 ·

Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

DLL Load By System Process From Suspicious Locations

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

DLL Loaded From Suspicious Location Via Cmspt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 ·

Share on:

Detects cmstp loading "dll" or "ocx" files from suspicious locations

DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

DLL Search Order Hijackig Via Additional Space in Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·

Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

DLL Sideloading by VMware Xfer Utility

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

DllUnregisterServer Function Call Via Msiexec.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·

Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

DNS Query Request By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·

Share on:

Detects DNS queries initiated by "Regsvr32.exe"

DNS Server Error Failed Loading the ServerLevelPluginDLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

DNS-over-HTTPS Enabled by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1112 ·

Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·

Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

Drop Binaries Into Spool Drivers Color Folder

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color" as seen in the blog referenced below

DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

DumpStack.log Defender Evasion

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects the use of the filename DumpStack.log to evade Microsoft Defender

Dynamic .NET Compilation Via Csc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·

Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Dynamic CSharp Compile Artefact

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·

Share on:

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Enable BPF Kprobes Tracing

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects common command used to enable bpf kprobes tracing

Enable LM Hash Storage - ProcCreation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Enable Local Manifest Installation With Winget

Aug 12, 2024 · attack.defense-evasion attack.persistence ·

Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Enabling COR Profiler Environment Variables

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.012 ·

Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Equation Group DLL_U Export Function Load

Aug 12, 2024 · attack.g0020 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects a specific export function name used by one of EquationGroup tools

ETW Logging Disabled For rpcrt4.dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

ETW Logging Disabled For SCM

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

ETW Logging Disabled In .NET Processes - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Logging Tamper In .NET Processes Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Trace Evasion Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·

Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

EventLog EVTX File Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

EvilNum APT Golden Chickens Deployment Via OCX Files

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

EVTX Created In Uncommon Location

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

Exchange PowerShell Cmdlet History Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execute Files with Msdeploy.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects file execution using the msdeploy.exe lolbin

Execute From Alternate Data Streams

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Execute MSDT Via Answer File

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Execute Pcwrun.EXE To Leverage Follina

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Execution DLL of Choice Using WAB.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

Execution Of Non-Existing File

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Execution via stordiag.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

Execution via WorkFolders.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects using WorkFolders.exe to execute an arbitrary control.exe

Exploit for CVE-2015-1641

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 cve.2015-1641 detection.emerging-threats ·

Share on:

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

Explorer NOUACCHECK Flag

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·

Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Explorer Process Tree Break

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Exports Registry Key To an Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Exports the target Registry key and hides it in the specified alternate data stream.

Failed Code Integrity Checks

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·

Share on:

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

Fax Service DLL Search Order Hijack

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 attack.t1574.002 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

File Creation Date Changed to Another Year

Aug 12, 2024 · attack.t1070.006 attack.defense-evasion ·

Share on:

Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.

File Decoded From Base64/Hex Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

File Deleted Via Sysinternals SDelete

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

File Deletion

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

File Deletion Via Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

File Download Using ProtocolHandler.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

File Download Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file

File Download Via Bitsadmin To A Suspicious Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

File Download Via Bitsadmin To An Uncommon Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

File Download Via InstallUtil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE"

File Download Via Nscurl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 ·

Share on:

Detects the execution of the nscurl utility in order to download files.

File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

File Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

File or Folder Permissions Change

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·

Share on:

Detects file and folder permission changes.

File Time Attribute Change

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files

File Time Attribute Change - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files.

File With Suspicious Extension Downloaded Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

Files With System DLL Name In Unsuspected Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Files With System Process Name In Unsuspected Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036.005 ·

Share on:

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Filter Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·

Share on:

Detect filter driver unloading activity via fltmc.exe

Findstr Launching .lnk File

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1202 attack.t1027.003 ·

Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Fireball Archer Install

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects Archer malware invocation via rundll32

Firewall Disabled via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 attack.s0108 ·

Share on:

Detects netsh commands that turns off the Windows firewall

Firewall Rule Deleted Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Firewall Rule Update Via Netsh.EXE

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

Flash Player Update from Suspicious Location

Aug 12, 2024 · attack.initial-access attack.t1189 attack.execution attack.t1204.002 attack.defense-evasion attack.t1036.005 ·

Share on:

Detects a flashplayer update from an unofficial location

Flush Iptables Ufw Chain

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·

Share on:

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

Folder Removed From Exploit Guard ProtectedFolders List - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

Forest Blizzard APT - File Creation Activity

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Forest Blizzard APT - JavaScript Constrained File Creation

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Forest Blizzard APT - Process Creation Activity

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Function Call From Undocumented COM Interface EditionUpgradeManager

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

Gatekeeper Bypass via Xattr

Aug 12, 2024 · attack.defense-evasion attack.t1553.001 ·

Share on:

Detects macOS Gatekeeper bypass via xattr utility

Github High Risk Configuration Disabled

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.persistence attack.t1556 ·

Share on:

Detects when a user disables a critical security feature for an organization.

Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·

Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Github Push Protection Bypass Detected

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Github Push Protection Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Github Secret Scanning Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects if the secret scanning feature is disabled for an enterprise or repository.

Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Goofy Guineapig Backdoor IOC

Aug 12, 2024 · attack.execution attack.defense-evasion detection.emerging-threats ·

Share on:

Detects malicious indicators seen used by the Goofy Guineapig malware

Google Cloud Firewall Modified or Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Gpscript Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Greedy File Deletion Using Del

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·

Share on:

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Guest User Invited By Non Approved Inviters

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1078.004 ·

Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

HackTool - CobaltStrike BOF Injection Pattern

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1562.001 ·

Share on:

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

HackTool - Covenant PowerShell Launcher

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1564.003 ·

Share on:

Detects suspicious command lines used in Covenant luanchers

HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·

Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects some Empire PowerShell UAC bypass methods

HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects user agent and URI paths used by empire agents

HackTool - F-Secure C3 Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·

Share on:

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

HackTool - HandleKatz Duplicating LSASS Handle

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1003.001 ·

Share on:

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

HackTool - Potential CobaltStrike Process Injection

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·

Share on:

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

HackTool - PowerTool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

HackTool - SharpDPAPI Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

HackTool - SharpEvtMute Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - SysmonEnte Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

HackTool - Wmiexec Default Powershell Command

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement ·

Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

HackTool - XORDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects suspicious use of XORDump process memory dumping utility

HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of "hh.exe" to open ".chm" files.

Hidden Executable In NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Hidden Files and Directories

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Hidden User Creation

Aug 12, 2024 · attack.defense-evasion attack.t1564.002 ·

Share on:

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Hide Schedule Task Via Index Value Tamper

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·

Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Hiding Files with Attrib.exe

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects usage of attrib.exe to hide files from users.

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Hypervisor Enforced Code Integrity Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel

Hypervisor Enforced Paging Translation Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·

Share on:

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Aug 12, 2024 · attack.execution attack.defense-evasion ·

Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Ie4uinit Lolbin Use From Invalid Path

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

IIS WebServer Access Logs Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

ImagingDevices Unusual Parent/Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Important Windows Event Auditing Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Important Windows Service Terminated Unexpectedly

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects important or interesting Windows services that got terminated unexpectedly.

Important Windows Service Terminated With Error

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects important or interesting Windows services that got terminated for whatever reason

Imports Registry Key From a File

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of the specified file to the registry with regedit.exe.

Imports Registry Key From an ADS

Aug 12, 2024 · attack.t1112 attack.defense-evasion ·

Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Increased Failed Authentications Of Any Type

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when sign-ins increased by 10% or greater.

Indicator Removal on Host - Clear Mac System Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects deletion of local audit logs

Indirect Command Execution By Program Compatibility Wizard

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·

Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Indirect Command Execution From Script File Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

Indirect Inline Command Execution Via Bash.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

InfDefaultInstall.exe .inf Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·

Share on:

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Insensitive Subfolder Search Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Install New Package Via Winget Local Manifest

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Install Root Certificate

Aug 12, 2024 · attack.defense-evasion attack.t1553.004 ·

Share on:

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Interactive Bash Suspicious Children

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.004 attack.t1036 ·

Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

Internet Explorer DisableFirstRunCustomize Enabled

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Invoke-Obfuscation CLIP+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation Obfuscated IEX Invocation

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Invoke-Obfuscation Obfuscated IEX Invocation - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Invoke-Obfuscation Obfuscated IEX Invocation - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation STDIN+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts