attack.defense-evasion | Detection.FYI

NetNTLM Downgrade Attack - Registry

Dec 3, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Dec 3, 2024 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Msiexec Quiet Installation

Dec 1, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Non-privileged Usage of Reg or Powershell

Dec 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Read More
Suspicious Scheduled Task Creation via Masqueraded XML File

Dec 1, 2024 · attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·
Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Read More
Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Read More
UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read More
UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Read More
UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

Read More
UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Read More
Setup16.EXE Execution With Custom .Lst File

Dec 1, 2024 · attack.defense-evasion attack.t1574.005 ·
Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Read More
Suspicious ShellExec_RunDLL Call Via Ordinal

Dec 1, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Read More
Suspicious Usage Of ShellExec_RunDLL

Dec 1, 2024 · attack.defense-evasion ·
Share on:

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Read More
All Rules Have Been Deleted From The Windows Firewall Configuration

Dec 1, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Read More
CodePage Modification Via MODE.COM To Russian Language

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

Read More
GCP Break-glass Container Workload Deployed

Dec 1, 2024 · attack.defense-evasion attack.t1548 ·
Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Read More
HackTool - EDRSilencer Execution - Filter Added

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

Read More
Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Dec 1, 2024 · detection.emerging-threats attack.defense-evasion attack.execution ·
Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Read More
Potential Pikabot Hollowing Activity

Dec 1, 2024 · attack.defense-evasion attack.t1055.012 detection.emerging-threats ·
Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Read More
Potentially Suspicious Self Extraction Directive File Created

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.

Read More
Remote CHM File Download/Execution Via HH.EXE

Dec 1, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Read More
Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Read More
Self Extraction Directive File Created In Potentially Suspicious Location

Dec 1, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.

Read More
System Control Panel Item Loaded From Uncommon Location

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

Read More
Windows Filtering Platform Blocked Connection From EDR Agent Binary

Dec 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Read More
Creation of WerFault.exe/Wer.dll in Unusual Folder

Nov 29, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Read More
HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
HackTool - GMER Rootkit Detector and Remover Execution

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects the execution GMER tool based on image and hash fields.

Read More
HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·
Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Read More
HackTool - PPID Spoofing SelectMyParent Tool Execution

Nov 25, 2024 · attack.defense-evasion attack.t1134.004 ·
Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Read More
HackTool - SharpEvtMute DLL Load

Nov 25, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·
Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Read More
HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Read More
HackTool Named File Stream Created

Nov 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Read More
Malicious DLL Load By Compromised 3CXDesktopApp

Nov 25, 2024 · attack.defense-evasion detection.emerging-threats ·
Share on:

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

Read More
MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Read More
Potential Compromised 3CXDesktopApp Execution

Nov 25, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·
Share on:

Detects execution of known compromised version of 3CXDesktopApp

Read More
Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More
PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
Remote Access Tool - NetSupport Execution From Unusual Location

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Read More
Renamed AutoIt Execution

Nov 25, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Read More
Renamed NetSupport RAT Execution

Nov 25, 2024 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Read More
Renamed PAExec Execution

Nov 25, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Read More
WinDivert Driver Load

Nov 25, 2024 · attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·
Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Read More
ESXi Syslog Configuration Change Via ESXCLI

Nov 20, 2024 · attack.defense-evasion attack.t1562.001 attack.t1562.003 ·
Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

Read More
Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·
Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Read More
Potentially Suspicious Cabinet File Expansion

Nov 17, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Read More
.RDP File Created by Outlook Process

Nov 4, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use RDP files as attachments.

Read More
.RDP File Created By Uncommon Application

Nov 1, 2024 · attack.defense-evasion ·
Share on:

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

Read More
Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Read More
DLL Names Used By SVR For GraphicalProton Backdoor

Nov 1, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Hunts known SVR-specific DLL names.

Read More
Enable LM Hash Storage

Nov 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Forfiles.EXE Child Process Masquerading

Nov 1, 2024 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

Read More
HackTool - EDRSilencer Execution

Nov 1, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

Read More
HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Read More
Potential Base64 Decoded From Images

Nov 1, 2024 · attack.defense-evasion attack.t1140 ·
Share on:

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Read More
Potential PowerShell Execution Policy Tampering

Nov 1, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Read More
Potentially Suspicious Desktop Background Change Using Reg.EXE

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Potentially Suspicious Desktop Background Change Via Registry

Nov 1, 2024 · attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
PSScriptPolicyTest Creation By Uncommon Process

Nov 1, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Read More
Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Read More
Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Read More
Suspicious Wordpad Outbound Connections

Nov 1, 2024 · attack.defense-evasion attack.command-and-control ·
Share on:

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

Read More
System Information Discovery Using System_Profiler

Nov 1, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·
Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Read More
Tamper Windows Defender - PSClassic

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Read More
Tamper Windows Defender - ScriptBlockLogging

Nov 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Read More
Uncommon Child Process Of Conhost.EXE

Nov 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Read More
BITS Transfer Job Download From File Sharing Domains

Oct 25, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
Suspicious File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Suspicious Windows Service Tampering

Oct 25, 2024 · attack.defense-evasion attack.t1489 ·
Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Read More
Unusual File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Disable Windows Defender Functionalities Via Registry Keys

Oct 8, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Read More
Potential Python DLL SideLoading

Oct 6, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of Python DLL files.

Read More
ETW Logging/Processing Option Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Read More
HTTP Logging Disabled On IIS Server

Oct 6, 2024 · attack.defense-evasion attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Read More
New Module Module Added To IIS Server

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the addition of a new module to an IIS server.

Read More
Previously Installed IIS Module Was Removed

Oct 6, 2024 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the removal of a previously installed IIS module.

Read More
Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new potentially suspicious download sources

Read More
Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Read More
Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Disable Internal Tools or Feature in Registry

Oct 1, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Oct 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·
Share on:

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Read More
Execution of Suspicious File Type Extension

Oct 1, 2024 · attack.defense-evasion ·
Share on:

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Important Windows Eventlog Cleared

Oct 1, 2024 · attack.defense-evasion attack.t1070.001 car.2016-04-002 ·
Share on:

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Read More
Load Of RstrtMgr.DLL By A Suspicious Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Load Of RstrtMgr.DLL By An Uncommon Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Read More
Potential Linux Process Code Injection Via DD Utility

Oct 1, 2024 · attack.defense-evasion attack.t1055.009 ·
Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Read More
Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·
Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Read More
Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Remote Thread Creation Via PowerShell In Uncommon Target

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 ·
Share on:

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Read More
Remote XSL Execution Via Msxsl.EXE

Oct 1, 2024 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Read More
Suspicious Path In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Read More
Uncommon Extension In Keyboard Layout IME File Registry Value

Oct 1, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Read More
Windows Defender Exclusion Registry Key - Write Access Requested

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

Read More
Windows Defender Real-time Protection Disabled

Sep 22, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Read More
HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Read More
Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Read More
Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·
Share on:

Detect DLL Load from Spooler Service backup folder

Read More
Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·
Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

Read More
IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·
Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Read More
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Sep 6, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Read More
Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·
Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Read More
Process Deletion of Its Own Executable

Sep 3, 2024 · attack.defense-evasion ·
Share on:

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Read More
Dism Remove Online Package

Sep 3, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Diamond Sleet APT DLL Sideloading Indicators

Sep 2, 2024 · attack.defense-evasion attack.t1574.002 detection.emerging-threats ·
Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Read More
Diamond Sleet APT Scheduled Task Creation - Registry

Sep 2, 2024 · attack.defense-evasion attack.t1562 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Read More
HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Read More
Injected Browser Process Spawning Rundll32 - GuLoader Activity

Sep 2, 2024 · attack.defense-evasion attack.t1055 detection.emerging-threats ·
Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Read More
Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
Obfuscated PowerShell OneLiner Execution

Sep 2, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Sep 2, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

Read More
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Read More
Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Read More
Potentially Suspicious Office Document Executed From Trusted Location

Sep 2, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Read More
Python Function Execution Security Warning Disabled In Excel

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More
Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Read More
Suspicious LNK Double Extension File Created

Sep 2, 2024 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Read More
A Rule Has Been Deleted From The Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Read More
Uncommon AppX Package Locations

Aug 29, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is located in uncommon locations

Read More
Uncommon New Firewall Rule Added In Windows Firewall Exception List

Aug 29, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a rule has been added to the Windows Firewall exception list

Read More
Antivirus Filter Driver Disallowed On Dev Drive - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

Read More
Hiding User Account Via SpecialAccounts Registry Key

Aug 29, 2024 · attack.defense-evasion attack.t1564.002 ·
Share on:

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
Potential AMSI Bypass Via .NET Reflection

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Read More
Python Function Execution Security Warning Disabled In Excel - Registry

Aug 29, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More
RestrictedAdminMode Registry Value Tampering

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
RestrictedAdminMode Registry Value Tampering - ProcCreation

Aug 29, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·
Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Read More
Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Aug 29, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Read More
COM Object Execution via Xwizard.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

Read More
New Capture Session Launched Via DXCap.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Read More
Potential DLL Sideloading Using Coregen.exe

Aug 29, 2024 · attack.defense-evasion attack.t1218 attack.t1055 ·
Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Read More
Program Executed Using Proxy/Local Command Via SSH.EXE

Aug 29, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Read More
Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Read More
Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Read More
Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Read More
Xwizard.EXE Execution From Non-Default Location

Aug 29, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Read More
Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 23, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Read More
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Aug 23, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Read More
Suspicious Remote AppX Package Locations

Aug 23, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package added to the pipeline of the "to be processed" packages which was downloaded from a suspicious domain.

Read More
Driver Added To Disallowed Images In HVCI - Registry

Aug 21, 2024 · attack.defense-evasion ·
Share on:

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

Read More
Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Read More
Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 16, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Read More
Powershell Token Obfuscation - Powershell

Aug 13, 2024 · attack.defense-evasion attack.t1027.009 ·
Share on:

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abusing Print Executable

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Attackers can use print.exe for remote file copy

Read More
Account Created And Deleted Within A Close Time Frame

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when an account was created and deleted in a short period of time.

Read More
Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
Activate Suppression of Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Read More
Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
AD Object WriteDAC Access

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·
Share on:

Detects WRITE_DAC access to a domain object

Read More
Add DisallowRun Execution to Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Read More
Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Read More
Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new additional download sources

Read More
Add or Remove Computer from DC

Aug 12, 2024 · attack.defense-evasion attack.t1207 ·
Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Read More
Add SafeBoot Keys Via Reg Utility

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Read More
AddinUtil.EXE Execution From Uncommon Directory

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Read More
ADS Zone.Identifier Deleted By Uncommon Application

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Read More
AgentExecutor PowerShell Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Read More
Allow RDP Remote Assistance Feature

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Read More
AMSI Bypass Pattern Assembly GetType

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.execution ·
Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Read More
Amsi.DLL Loaded Via LOLBIN Process

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Read More
Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Read More
APT27 - Emissary Panda Activity

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.g0027 detection.emerging-threats ·
Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Read More
APT29 2018 Phishing Campaign CommandLine Indicators

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·
Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Read More
APT29 2018 Phishing Campaign File Indicators

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Read More
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Read More
Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Read More
Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Read More
Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Read More
Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Read More
AspNetCompiler Execution

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Read More
Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Read More
Atbroker Registry Change

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·
Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Read More
Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
Audit Policy Tampering Via Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Audit Policy Tampering Via NT Resource Kit Auditpol

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Auditing Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes in auditd configuration files

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
AWS CloudTrail Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling, deleting and updating of a Trail

Read More
AWS Config Disabling Channel/Recorder

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects AWS Config Service disabling

Read More
AWS GuardDuty Important Change

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

Read More
AWS SecurityHub Findings Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the modification of the findings on SecurityHub.

Read More
Azure Active Directory Hybrid Health AD FS New Server

Aug 12, 2024 · attack.defense-evasion attack.t1578 ·
Share on:

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Read More
Azure Active Directory Hybrid Health AD FS Service Delete

Aug 12, 2024 · attack.defense-evasion attack.t1578.003 ·
Share on:

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Read More
Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Azure Application Deleted

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1489 ·
Share on:

Identifies when a application is deleted in Azure.

Read More
Azure Firewall Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·
Share on:

Identifies when a firewall is created, modified, or deleted.

Read More
Azure Firewall Rule Collection Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.004 ·
Share on:

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Read More
Azure Kubernetes Events Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Read More
Azure Network Firewall Policy Modified or Deleted

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1562.007 ·
Share on:

Identifies when a Firewall Policy is Modified or Deleted.

Read More
Azure Owner Removed From Application or Service Principal

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Identifies when a owner is was removed from a application or service principal in Azure.

Read More
Azure Service Principal Created

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Identifies when a service principal is created in Azure.

Read More
Azure Service Principal Removed

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Identifies when a service principal was removed in Azure.

Read More
Backup Catalog Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects backup catalog deletions

Read More
Base64 Encoded PowerShell Command Detected

Aug 12, 2024 · attack.t1027 attack.defense-evasion attack.t1140 attack.t1059.001 ·
Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Read More
Binary Padding - Linux

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·
Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Read More
Binary Padding - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·
Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Read More
Bitbucket Audit Log Configuration Updated

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the bitbucket audit log configuration.

Read More
Bitbucket Global Secret Scanning Rule Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects Bitbucket global secret scanning rule deletion activity.

Read More
Bitbucket Global SSH Settings Changed

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·
Share on:

Detects Bitbucket global SSH access configuration changes.

Read More
Bitbucket Project Secret Scanning Allowlist Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a secret scanning allowlist rule is added for projects.

Read More
Bitbucket Secret Scanning Exempt Repository Added

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a repository is exempted from secret scanning feature.

Read More
Bitbucket Secret Scanning Rule Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when secret scanning rule is deleted for the project or repository.

Read More
Bitbucket User Login Failure

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Read More
Bitlocker Key Retrieval

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Bitlocker key retrieval.

Read More
BitLockerTogo.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

Read More
BITS Transfer Job Download From Direct IP

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

Read More
BITS Transfer Job Download To Potential Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Read More
BITS Transfer Job Downloading File Potential Suspicious Extension

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

Read More
BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Read More
Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read More
Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Read More
Blackbyte Ransomware Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption

Read More
Bpfdoor TCP Ports Redirect

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Read More
Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Bypasses User Account Control using a fileless method

Read More
Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Read More
Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·
Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read More
Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Read More
C# IL Code Compilation Via Ilasm.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1127 ·
Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Read More
CA Policy Removed by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
Certificate Exported Via Certutil.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Read More
Change the Fax Dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect possible persistence using Fax DLL load when service restart

Read More
Change to Authentication Method

Aug 12, 2024 · attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Change User Account Associated with the FAX Service

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Read More
Change Winevt Channel Access Permission Via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Read More
Changes to Device Registration Policy

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484 ·
Share on:

Monitor and alert for changes to the device registration policy.

Read More
Chmod Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects chmod targeting files in abnormal directory paths.

Read More
Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco Clear Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·
Share on:

Clear command history in network OS which is used for defense evasion

Read More
Cisco Crypto Commands

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1553.004 attack.t1552.004 ·
Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Read More
Cisco Disabling Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Turn off logging locally or remote

Read More
Cisco Duo Successful MFA Authentication Via Bypass Code

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.initial-access ·
Share on:

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Read More
Cisco File Deletion

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·
Share on:

See what files are being deleted from flash file systems

Read More
Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
Clear Linux Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion

Read More
Clearing Windows Console History

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1070.003 ·
Share on:

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Read More
ClickOnce Trust Prompt Tampering

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Read More
CMSTP Execution Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CobaltStrike Load by Rundll32

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Read More
CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe as used by CobaltStrike

Read More
CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

Read More
CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·
Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Read More
Code Execution via Pcwutl.dll

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Read More
COLDSTEEL Persistence Service Creation

Aug 12, 2024 · attack.defense-evasion attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

Read More
COLDSTEEL RAT Anonymous User Process Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

Read More
COLDSTEEL RAT Cleanup Command Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

Read More
COLDSTEEL RAT Service Persistence Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Read More
Commands to Clear or Remove the Syslog

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks

Read More
ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·
Share on:

Detects Turla ComRAT network communication.

Read More
Connection Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1090 ·
Share on:

Detects setting proxy configuration

Read More
Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Read More
Created Files by Microsoft Sync Center

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Read More
CreateDump Process Dump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Read More
Creation Of a Suspicious ADS File Outside a Browser Download

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

Read More
Creation Of Non-Existent System DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Read More
Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Read More
Custom File Open Handler Executes PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the abuse of custom file open handler, executing powershell

Read More
CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Aug 12, 2024 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 ·
Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Read More
Decode Base64 Encoded Text

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Read More
Decode Base64 Encoded Text -MacOs

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·
Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Read More
Deployment AppX Package Was Blocked By AppLocker

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package deployment that was blocked by AppLocker policy

Read More
Deployment Of The AppX Package Was Blocked By The Policy

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects an appx package deployment that was blocked by the local computer policy

Read More
Detect Virtualbox Driver Installation OR Starting Of VMs

Aug 12, 2024 · attack.defense-evasion attack.t1564.006 attack.t1564 ·
Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Read More
Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
Device Registration or Join Without MFA

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Read More
DeviceCredentialDeployment Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view

Read More
Devtoolslauncher.exe Executes Specified Binary

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

The Devtoolslauncher.exe executes other binary

Read More
DHCP Callout DLL Installation

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Read More
DHCP Server Error Failed Loading the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

Read More
DHCP Server Loaded the CallOut DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Read More
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 cve.2022-30190 ·
Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

Read More
Directory Removal Via Rmdir

Aug 12, 2024 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
Disable Administrative Share Creation at Startup

Aug 12, 2024 · attack.defense-evasion attack.t1070.005 ·
Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Read More
Disable Exploit Guard Network Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Read More
Disable Macro Runtime Scan Scope

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Read More
Disable Microsoft Defender Firewall via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Read More
Disable of ETW Trace - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Read More
Disable Or Stop Services

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services

Read More
Disable Powershell Command History

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·
Share on:

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Read More
Disable Privacy Settings Experience in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects registry modifications that disable Privacy Settings Experience

Read More
Disable PUA Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender PUA protection

Read More
Disable Security Events Logging Adding Reg Key MiniNt

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.

Read More
Disable Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling security tools

Read More
Disable System Firewall

Aug 12, 2024 · attack.t1562.004 attack.defense-evasion ·
Share on:

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Read More
Disable Tamper Protection on Windows Defender

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender Tamper Protection

Read More
Disable Windows Defender AV Security Monitoring

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Read More
Disable Windows Event Logging Via Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Read More
Disable Windows Firewall by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detect set EnableFirewall to 0 to disable the Windows firewall

Read More
Disable Windows IIS HTTP Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·
Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Read More
Disable Windows Security Center Notifications

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·
Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Read More
Disable-WindowsOptionalFeature Command PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Disabled IE Security Features

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Read More
Disabled Volume Snapshots

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects commands that temporarily turn off Volume Snapshots

Read More
Disabled Windows Defender Eventlog

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Read More
Disabling Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects disabling security tools

Read More
Disabling Security Tools - Builtin

Aug 12, 2024 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects disabling security tools

Read More
Diskshadow Script Mode - Uncommon Script Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Read More
Displaying Hidden Files Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

Read More
DLL Execution via Rasautou.exe

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

Read More
DLL Execution Via Register-cimprovider.exe

Aug 12, 2024 · attack.defense-evasion attack.t1574 ·
Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read More
DLL Load By System Process From Suspicious Locations

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·
Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

Read More
DLL Loaded From Suspicious Location Via Cmspt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 ·
Share on:

Detects cmstp loading "dll" or "ocx" files from suspicious locations

Read More
DLL Loaded via CertOC.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

Read More
DLL Search Order Hijackig Via Additional Space in Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.002 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading by VMware Xfer Utility

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·
Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Read More
DllUnregisterServer Function Call Via Msiexec.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Read More
DNS Query Request By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects DNS queries initiated by "Regsvr32.exe"

Read More
DNS Server Error Failed Loading the ServerLevelPluginDLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·
Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Read More
DNS-over-HTTPS Enabled by Registry

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1112 ·
Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Read More
Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·
Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Read More
Driver/DLL Installation Via Odbcconf.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

Read More
Drop Binaries Into Spool Drivers Color Folder

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color" as seen in the blog referenced below

Read More
DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·
Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Read More
DumpStack.log Defender Evasion

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the use of the filename DumpStack.log to evade Microsoft Defender

Read More
Dynamic .NET Compilation Via Csc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Read More
Dynamic CSharp Compile Artefact

Aug 12, 2024 · attack.defense-evasion attack.t1027.004 ·
Share on:

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Read More
Enable BPF Kprobes Tracing

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects common command used to enable bpf kprobes tracing

Read More