attack.defense_evasion

Deleting Windows Defender scheduled tasks

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects the deletion of scheduled tasks related to Windows Defender.

Enabling RDP service via reg.exe command execution

Aug 10, 2024 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Enabling restricted admin mode

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects the registry modification to enable restricted admin mode using reg.exe

Injected Browser Process Spawning Rundll32

Aug 10, 2024 · attack.defense_evasion attack.T1055 ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Onenote execution of malicious embedded scripts

Aug 10, 2024 · attack.defense_evasion attack.T1218.001 ·

Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a onenote attachment and then on the malicious link inside the .one file, it exports and executes the malicious embedded script from specific directories.

PowerShell AMSI Bypass Pattern

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 attack.execution ·

Share on:

Detects attempts to disable AMSI in the commandline. It is possible to bypass AMSI by disabling it before loading the main payload.

Using powershell specific download cradle OneLiner

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 attack.execution T1059.001 ·

Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

VSDiagnostics used for proxying execution malicious binaries

Aug 10, 2024 · attack.defense_evasion attack.T1218 ·

Share on:

Detects the subvert execution of malicious payloads using vsdiagnostics.exe. VSDiagnostics.exe is an executable part of the Microsoft Visual Studio. Threat actors can use the start to start a new session in combination with the /launch and /launchargs parameters to execute a malicious payload on disk.

Application Bypass with DllRegisterServer Function

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

DLLs that are designed to be loaded by Regsvr32 are expected to have a DllRegisterServer export function implemented. Adversaries will often supply the same DLL to rundll32.exe as well. Executing the DllRegisterServer export function with rundll32.exe is tradecraft that’s unique to adversary behavior and is rarely seen in legitimate scenarios. We’ve observed this behavior in threats including Qbot, Ursnif, and Zloader, to name a few examples. Part of the RedCanary 2024 Threat Detection Report.

Base64 Encoding

Mar 26, 2024 · attack.defense_evasion attack.t1027 ·

Share on:

If you’re looking to detect malicious use of Base64 encoding, consider monitoring for the execution of processes like powershell.exe or cmd.exe along with command lines containing parameters like ToBase64String and FromBase64String. The following simple pseudo-analytic might help you find malicious obfuscation. Part of the RedCanary 2024 Threat Detection Report.

Bypassing Security Controls - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1202 ·

Share on:

Adversaries bypass controls using the Windows Command Shell in a plethora of ways, but you can detect the one we see most often with a simple combination of process execution and a corresponding command line. Part of the RedCanary 2024 Threat Detection Report.

Gamarue Rundll32.exe Long Commandlines

Mar 26, 2024 · attack.defense_evasion attack.t1027 attack.t1027.010 ·

Share on:

Fortunately for defenders, Gamarue is detectable with endpoint telemetry. The majority of Gamarue activity we see involves rundll32.exe executing with unusual command lines that include long filenames with repeating characters and random function names. Part of the RedCanary 2024 Threat Detection Report.

Obfuscated Commands - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Detecting obfuscation in the command shell is relatively straightforward, but there are a lot of variations to consider when you’re developing detection coverage. Of course, the process you’re looking for will always be cmd.exe, but the corresponding command line can contain a variety of suspicious characters. The trick is finding the thresholds where the inclusion of obfuscation characters go from normal to anomalous (but benign) to suspicious enough to warrant alerting. The following pseudo-detection logic offers a good starting point for developing detection coverage for obfuscation in the command line. Part of the RedCanary 2024 Threat Detection Report.

Obfuscation and Escape Characters - Powershell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·

Share on:

This analytic looks for the execution of a process that seems to be powershell.exe along with a corresponding command line containing the term base64. Base64 encoding isn’t inherently suspicious, but it’s worth looking out for in a lot of environments, and the following pseudo-detection logic can help detect a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

PowerShell -encodedcommand Switch

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·

Share on:

This detection analytic looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument; PowerShell will recognize and accept anything from -e onward, and it will show up outside of the encoded bits. Part of the RedCanary 2024 Threat Detection Report.

PowerShell Base64 Encoding

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·

Share on:

This analytic looks for the execution of a process that seems to be powershell.exe along with a corresponding command line containing the term base64. Base64 encoding isn’t inherently suspicious, but it’s worth looking out for in a lot of environments, and the following pseudo-detection logic can help detect a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

PowerShell Suspicious .NET Methods

Mar 26, 2024 · attack.defense_evasion attack.t1140 attack.t1574 attack.t1574.013 ·

Share on:

Detects the loading of suspicious .NET methods, seen in PowerShell script load content. This behavior is not limited to Yellow Cockatoo and can be applied universally for malicious PowerShell obfuscation attempts. Part of the RedCanary 2024 Threat Detection Report.

Processes Executing with Unusual Command Lines

Mar 26, 2024 · attack.defense_evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects powershell command lines used with a process name besides powershell. Part of the RedCanary 2024 Threat Detection Report.

Rundll32 Injection into LSASS

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.t1055 ·

Share on:

The following pseudo-detector should help security teams detect instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2024 Threat Detection Report.

Rundll32 with Suspicious Process Lineage

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

As is the case with most techniques in this report, it's critical that you are able to take stock of what is normal in your environment if you hope to be able to identify what isn't. In the context of Rundll32, you’ll want to monitor for executions of rundll32.exe from unusual parent processes, and the following pseudo-analytic—based on an amalgamation of Red Canary detection logic—should help security teams do just that. Part of the RedCanary 2024 Threat Detection Report.

Rundll32 Without a Command Line

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Rundll32 does not normally execute without corresponding command-line arguments and while spawning a child process. Given this, you may want to alert on the execution of processes that appear to be rundll32.exe without any command-line arguments , especially when they spawn child processes or make network connections. Part of the RedCanary 2024 Threat Detection Report.

Suspicious Export Functionalities - Rundll32

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.credential_access attack.t1003 ·

Share on:

Consider monitoring for instances of rundll32.exe running Windows native DLLs that have export functionalities that adversaries commonly leverage for executing malicious code and evading defensive controls. The following pseudo-analytic applies specifically to adversaries who use the MiniDump export functionality of comsvcs.dll to dump the contents of LSASS, but this logic could be adapted to detect other malicious activity as well. Part of the RedCanary 2024 Threat Detection Report.

Unexpected Internal Process Name

Mar 26, 2024 · attack.defense_evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects instances where the powershell process is renamed to notepad for defense evasion. Part of the RedCanary 2024 Threat Detection Report.

Windows Installer (msiexec.exe) Downloading and Executing Packages

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.007 ·

Share on:

To detect suspicious use of msiexec.exe by Raspberry Robin or other threats, it’s essential to take a look at the command line and the URL. Detecting msiexec.exe making outbound network connections to download and install packages in the command-line interface will give you the opportunity to examine the activity and determine if it’s malicious or not. Part of the RedCanary 2024 Threat Detection Report.

ZIP File Spawning JavaScript

Mar 26, 2024 · attack.defense_evasion attack.t1027 ·

Share on:

RedCanary detected high volumes of obfuscation this year looking for apparent phishing schemes where adversaries conceal JavaScript payloads in ZIP files and write them to the users and temp directories. Part of the RedCanary 2024 Threat Detection Report.

JavaScript Execution Using MSDOS 8.3 File Notation

Feb 26, 2024 · attack.defense_evasion attack.t1059 dist.public ·

Share on:

Detects script execution using MSDOS 8.3 File names

Custom Cobalt Strike Command Execution

Feb 23, 2024 · attack.defense_evasion attack.t1562.001 attack.execution attack.t1059.001 ·

Share on:

Detects the execution of a specific OneLiner to Invoke PowerShell commands.

Deleting Windows Defender scheduled tasks

Feb 23, 2024 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects the deletion of scheduled tasks related to Windows Defender.

FlawedGrace spawning threat injection target

Feb 23, 2024 · attack.defense_evasion attack.t1055 dist.public ·

Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Hiding local user accounts

Feb 23, 2024 · attack.t1564.002 attack.defense_evasion ·

Share on:

Detects the use reg.exe to hide users from listed in the logon screen. This is possible by changing the registry key value to 0 for a specific user.

Enable WDigest using PowerShell

Feb 22, 2024 · attack.defense_evasion attack.t1112 ·

Share on:

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Enabling RDP service via reg.exe command execution

Feb 22, 2024 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Enabling restricted admin mode

Feb 22, 2024 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects the registry modification to enable restricted admin mode using reg.exe

Conhost Suspicious Command Execution

Nov 1, 2023 · attack.defense_evasion attack.t1564.003 dist.public ·

Share on:

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Suspicious Calc Child Process

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the suspicious child process of calc

Suspicious Process Injection to Explorer

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the suspicious child process of regsvr32

Gootloader JavaScript Execution in AppData Folder (RedCanary Threat Detection Report)

May 17, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects execution of JavaScript (.js) files located in the AppData folder. Part of the RedCanary 2023 Threat Detection Report.

ISO File Write to Suspicious Folder (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1553.005 ·

Share on:

Detects files written to user downloads folder or appdata folder, associated with Mark-of-the-Web Bypass. Part of the RedCanary 2023 Threat Detection Report.

Potential Homoglyph Attack Using Lookalike Characters

May 10, 2023 · attack.defense_evasion attack.t1036 attack.t1036.003 attack.t1036.008 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Processes Executing with Unusual Command Lines (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects non-powershell.exe processes executing with command lines that are usually associated with powershell. This is an example for demonstration purposes only. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Application Bypass with DllRegisterServer Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the DllRegisterServer export function implemented with Rundll32. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Injection into LSASS (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances of Rundll32 being spawned by unusual or suspicious parent processes. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Without a Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances of Rundll32 without a command line spawning child processes. Part of the RedCanary 2023 Threat Detection Report.

Unexpected Internal Process Name (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects powershell processes renamed to notepad.exe. This is a narrow example for demonstration purposes only. Part of the RedCanary 2023 Threat Detection Report.

Windows Scripting Host Executing JScript Files with MS-DOS Short Names (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Windows scripting host executing JavaScript files with MS-DOS shortname formatting, a technique associated with Gootloader. Part of the RedCanary 2023 Threat Detection Report.

Yellow Cockatoo Powershell Startup Folder Persistence (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects .lnk files created by Powershell in the startup folder. Associated with (but not unique to) Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Yellow Cockatoo PowerShell Suspicious .NET Methods (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects suspicious Powershell script load contents associated with Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

AWS Macie Evasion

Apr 21, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects evade to Macie detection.

Defense evasion via process reimaging

Apr 21, 2023 · attack.defense_evasion ·

Share on:

Detects process reimaging defense evasion technique

Execution via CL_Invocation.ps1 (2 Lines)

Apr 21, 2023 · attack.defense_evasion attack.t1216 ·

Share on:

Detects Execution via SyncInvoke in CL_Invocation.ps1 module

Execution via CL_Mutexverifiers.ps1 (2 Lines)

Apr 21, 2023 · attack.defense_evasion attack.t1216 ·

Share on:

Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module

File Creation by Office Applications

Apr 21, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·

Share on:

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Files Dropped to Program Files by Non-Priviledged Process

Apr 21, 2023 · attack.persistence attack.defense_evasion attack.t1574 attack.t1574.010 ·

Share on:

Search for dropping of files to Windows/Program Files fodlers by non-priviledged processes

Invoke-Obfuscation CLIP+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation Obfuscated IEX Invocation

Apr 21, 2023 · attack.defense_evasion attack.t1027 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework (See reference section for code block)

Invoke-Obfuscation RUNDLL LAUNCHER

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation STDIN+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use MSHTA

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use Rundll32

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Renamed Autohotkey Binary

Feb 6, 2023 · attack.defense_evasion attack.t1036.003 ·

Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

DNS Query From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects DNS queries from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Download by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects downloads by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

File Creation by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects file creations by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Network Connection From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·

Share on:

Detects network connections from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Process Creation With Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.007 ·

Share on:

Detects process creation utilizing double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Suspicious Command Line Containing Right-to-Left Override

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.002 ·

Share on:

Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.

Suspicious Process Injection to RegAsm

Jan 30, 2023 · attack.defense_evasion attack.t1218 attack.t1218.009 ·

Share on:

Detects potential process injection of RegAsm.exe as indicated by lack of command-line arguments. This was observed in a recent campaign to distribute AsyncRAT and Quasar RAT using malicious OneNot files.

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Powershell MS Defender Tampering - ScriptBlockLogging

Jan 12, 2023 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects powershell scripts attempting to disable MS Defender components using Set-MpPreference as performed by Vice Society ransomware gang. This includes additional techniques to evade existing rules by feeding in a proxy value of $true using a powershell boolean expression like (0 -eq $false).

Mshta Executing from Registry

Jan 9, 2023 · attack.defense_evasion attack.t1218.005 ·

Share on:

Detects a Mshta executing code from the registry

Bumblebee WmiPrvSE execution pattern

Jan 8, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Bumblebee WmiPrvSE parent process manipulation

Enable WDigest using PowerShell (ps_module)

Jan 8, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Rule to detect registry modifications to enable WDigest using powershell script modules.

ISO, VHD, LNK or IMG File Extracted from Zip (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 attack.t1564 ·

Share on:

Detects extraction of ISO, VHD, LNK, or IMG files from zip files. Commonly associated with QakBot and IcedID.

Web Browser Creates Zip Archive File (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 ·

Share on:

Detects browser applications creating archive/container files such as zip, rar, or 7z, as occurs during an HTML smuggling attack where a browser decodes and executes malicious code within an HTML file. Commonly associated with QakBot and IcedID.

Suspicious Use of Rcedit Utility to Alter Executable Metadata

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·

Share on:

Detects the suspicious use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Command or Scripting Interpreter Creating EXE File

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 ·

Share on:

Detects the suspicious child use of shell or scripting interpreter to create a file ending in exe.

File Creation of Executables in Temp Folders (Event 4663)

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 ·

Share on:

Detects creation of files potentially matching attempts to copy executables to temporary directories to hide usage.

Process Creation without .exe File Extension

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.s1020 ·

Share on:

Detects process creations where the Image does not have a .exe file extension.

Suspicious Process Execution in PerfLogs Directory

Dec 6, 2022 · attack.defense_evasion attack.t1564 ·

Share on:

Detects process execution in PerfLogs folder - a folder used by Windows for log collection - and matching previously-observed naming patterns for ransomware executables.

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Tampering of Windows Defender with Reg

Nov 29, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects use of the reg utility to tamper with MS Defender protections.

PowerShell -encodedcommand Switch

Nov 29, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Inspired by the 2022 Red Canary Threat Detection report.

Event Log Manipulation Using Wevtutil

Nov 22, 2022 · attack.defense_evasion attack.t1070 attack.g0092 ·

Share on:

Detects the use of wevtutil to clear or otherwise manipulate Windows event logs.

Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Abusing PowerShell to Disable Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·

Share on:

Looks for instances of powershell being used to disable or impair Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Abusing PowerShell to Modify Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·

Share on:

Looks for instances of powershell being used to modify or degrade Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Application Bypass with RunDLL32 and DllRegisterServer Function

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.s0650 attack.s0386 ·

Share on:

DLLs that are designed to be loaded by Regsvr32 are expected to have a DllRegisterServer export function implemented. This detects use of the same DLL to rundll32.exe. Inspired by the 2022 Red Canary Threat Detection report.

Base64 Encoding in CMD or Powershell

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Looks for the execution of cmd.exe or powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

CMD Launching Batch Script Stored on External Drive (Chromeloader)

Nov 9, 2022 · attack.defense_evasion attack.t1553 attack.t1553.005 ·

Share on:

Detects instances of CMD executing a batch stored on an externally-mounted drives, in turn spawning a tar extraction process.

Command Shell Obfuscated Commands

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Looks for the execution of Windows Command Shell with unusually high counts of characters used for obfuscation. Inspired by the 2022 Red Canary Threat Detection report.

Gootloader Stage 2 Registry Key Creation

Nov 9, 2022 · attack.execution attack.defense_evasion attack.t1620 ·

Share on:

Detects potential stage 2 Gootloader registry key creation.

PowerShell Base64 Encoding

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Looks for the execution of powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

Powershell Obfuscation and Escape Characters

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Looks for the execution of PowerShell with unusually high counts of characters like ^, +, $, and %. Inspired by the 2022 Red Canary Threat Detection report.

Process Executing with Unusual Command Lines

Nov 9, 2022 · attack.defense_evasion attack.t1036.003 ·

Share on:

Looks for the execution of non-powershell process with command lines matching common powershell format. Inspired by the 2022 Red Canary Threat Detection report.

Process Executing with Unusual Command Lines

Nov 9, 2022 · attack.defense_evasion attack.t1036.003 ·

Share on:

Looks for the execution of non-powershell process with command lines matching common powershell format. Inspired by the 2022 Red Canary Threat Detection report.

Rundll32 with Suspicious Export Functionalities

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Detects instances of rundll32.exe running Windows native DLLs that have export functionalities that adversaries commonly leverage for executing malicious code and evading defensive controls. Inspired by the 2022 Red Canary Threat Detection report.

Rundll32 with Suspicious Process Lineage

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Detects executions of rundll32.exe from unusual or suspicious parent processes. Inspired by the 2022 Red Canary Threat Detection report.

Rundll32 without Command Line

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Detects instances of rundll32.exe with no command line that spawns a child process. Inspired by the 2022 Red Canary Threat Detection report.

Svchost Not Matching Normal Execution Parameters

Nov 9, 2022 · attack.defense_evasion attack.t1036 attack.t1036.005 ·

Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Unexpected Internal Process Name

Nov 9, 2022 · attack.defense_evasion attack.t1036 attack.t1036.003 ·

Share on:

Looks for the execution of powershell renamed as Notepad.exe. Inspired by the 2022 Red Canary Threat Detection report.

Solarmarker File Extension Registry Key Set

Nov 9, 2022 · attack.defense_evasion attack.t1202 ·

Share on:

Detects creation of suspicious file extension registry key. This extension is then registered with a custom file type (see Detail component of detection below) with a malicious powershell payload specified.