attack.defense-evasion

ArcSOC.exe Creating Suspicious Files

Nov 25, 2025 · attack.defense-evasion attack.command-and-control attack.persistence attack.t1127 attack.t1105 attack.t1133 ·

Share on:

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates files with suspicious file types, indicating that they may be executables, script files, or otherwise unusual.

Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·

Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·

Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

CMSTP installation of malicious code

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·

Share on:

Detects the execution of CMSTP that is used install fake Connection Manager Profiles via contains via .INF files that resign on a temp location on disk and contains instructions for how the Connection Manager should install the profile. The .INF files could contain malicious code under the section RunPreSetupCommandsSection which is the commands to run before setup.

Dumpbin LOLBin use for proxying execution via link.exe

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·

Share on:

Using dumpbin.exe, a windows binary that is installed along side visual studio versions. When dumbin.exe is executed, it is calling link.exe without checking the legitimacy of the link.exe named binary in the same directory.

MSTeams exe side-loading - Update.exe

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·

Share on:

Detects execution of side-loaded executable via the update.exe, part microsoft teams' application binary.

Wermgr.exe spawning without command line arguments

Aug 10, 2024 · attack.Defense Evasion attack.T1218 ·

Share on:

Wermgr.exe should not spawn without any command line arguments. Sometimes malware are using process injection to masquerade their malicious activities and evade detection.