attack.execution | Detection.FYI

Unusual Parent Process For Cmd.EXE

Dec 6, 2023 · attack.execution attack.t1059 ·
Share on:

Detects suspicious parent process for cmd.exe

Read More
HackTool - WinPwn Execution

Dec 4, 2023 · attack.credential_access attack.defense_evasion attack.discovery attack.execution attack.privilege_escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Dec 4, 2023 · attack.credential_access attack.defense_evasion attack.discovery attack.execution attack.privilege_escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
CMSTP Execution Process Access

Dec 4, 2023 · attack.defense_evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
Direct Syscall of NtOpenProcess

Dec 4, 2023 · attack.execution attack.t1106 ·
Share on:

Detects the usage of the direct syscall of NtOpenProcess which might be done from a CobaltStrike BOF.

Read More
HackTool - CobaltStrike BOF Injection Pattern

Dec 4, 2023 · attack.execution attack.t1106 attack.defense_evasion attack.t1562.001 ·
Share on:

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Read More
HackTool - HandleKatz Duplicating LSASS Handle

Dec 4, 2023 · attack.execution attack.t1106 attack.defense_evasion attack.t1003.001 ·
Share on:

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

Read More
HackTool - Impacket Tools Execution

Dec 4, 2023 · attack.execution attack.t1557.001 ·
Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Read More
HackTool - LittleCorporal Generated Maldoc Injection

Dec 4, 2023 · attack.execution attack.t1204.002 attack.t1055.003 ·
Share on:

Detects the process injection of a LittleCorporal generated Maldoc.

Read More
Remote LSASS Process Access Through Windows Remote Management

Dec 4, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral_movement attack.t1021.006 attack.s0002 ·
Share on:

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

Read More
Clipboard Data Collection Via OSAScript

Dec 1, 2023 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·
Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Read More
Enable BPF Kprobes Tracing

Dec 1, 2023 · attack.execution attack.defense_evasion ·
Share on:

Detects common command used to enable bpf kprobes tracing

Read More
Fsutil Behavior Set SymlinkEvaluation

Dec 1, 2023 · attack.execution attack.t1059 ·
Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Read More
Import PowerShell Modules From Suspicious Directories

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Import PowerShell Modules From Suspicious Directories - ProcCreation

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
JXA In-memory Execution Via OSAScript

Dec 1, 2023 · attack.t1059.002 attack.t1059.007 attack.execution ·
Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Read More
Malicious Nishang PowerShell Commandlets

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects Commandlet names and arguments from the Nishang exploitation framework

Read More
Malicious PowerShell Scripts - PoshModule

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Read More
Operator Bloopers Cobalt Strike Commands

Dec 1, 2023 · attack.execution attack.t1059.003 stp.1u ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Operator Bloopers Cobalt Strike Modules

Dec 1, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Read More
OSACompile Run-Only Execution

Dec 1, 2023 · attack.t1059.002 attack.execution ·
Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Read More
PDQ Deploy Remote Adminstartion Tool Execution

Dec 1, 2023 · attack.execution attack.lateral_movement attack.t1072 ·
Share on:

Detect use of PDQ Deploy remote admin tool

Read More
Potential CVE-2022-26809 Exploitation Attempt

Dec 1, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1569.002 cve.2022.26809 detection.emerging_threats ·
Share on:

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

Read More
Potential Discovery Activity Via Dnscmd.EXE

Dec 1, 2023 · attack.discovery attack.execution attack.t1543.003 ·
Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Read More
Potential Exploitation Attempt From Office Application

Dec 1, 2023 · attack.execution attack.defense_evasion cve.2021.40444 detection.emerging_threats ·
Share on:

Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

Read More
Potential Password Spraying Attempt Using Dsacls.EXE

Dec 1, 2023 · attack.execution attack.t1218 ·
Share on:

Detects possible password spraying attempts using Dsacls

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Dec 1, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential PowerShell Obfuscation Using Alias Cmdlets

Dec 1, 2023 · attack.defense_evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

Read More
Potential PowerShell Obfuscation Using Character Join

Dec 1, 2023 · attack.defense_evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

Read More
Potential Renamed Rundll32 Execution

Dec 1, 2023 · attack.execution ·
Share on:

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Read More
Potential WinAPI Calls Via CommandLine

Dec 1, 2023 · attack.execution attack.t1106 ·
Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Read More
Potentially Over Permissive Permissions Granted Using Dsacls.EXE

Dec 1, 2023 · attack.execution attack.t1218 ·
Share on:

Detects usage of Dsacls to grant over permissive permissions

Read More
PowerShell Base64 Encoded WMI Classes

Dec 1, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

Detects calls to base64 encoded WMI class such as "Win32_Shadowcopy", "Win32_ScheduledJob", etc.

Read More
Powershell XML Execute Command

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Read More
Query Usage To Exfil Data

Dec 1, 2023 · attack.execution ·
Share on:

Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Read More
Suspicious Binary In User Directory Spawned From Office Application

Dec 1, 2023 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Digital Signature Of AppX Package

Dec 1, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects execution of AppX packages with known suspicious or malicious signature

Read More
Suspicious Microsoft Office Child Process - MacOS

Dec 1, 2023 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
Suspicious New Instance Of An Office COM Object

Dec 1, 2023 · attack.execution attack.defense_evasion ·
Share on:

Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)

Read More
Suspicious PowerShell Download - PoshModule

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Uncommon One Time Only Scheduled Task At 00:00

Dec 1, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Usage Of Web Request Commands And Cmdlets - ScriptBlock

Dec 1, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Read More
Mint Sandstorm - Log4J Wstomcat Process Execution

Nov 29, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

Read More
Wusa.EXE Executed By Parent Process Located In Suspicious Location

Nov 28, 2023 · attack.execution ·
Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.

Read More
Wusa.EXE Extracting Cab Files From Suspicious Paths

Nov 28, 2023 · attack.execution ·
Share on:

Detects usage of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument from suspicious paths

Read More
Potential APT FIN7 POWERHOLD Execution

Nov 28, 2023 · attack.execution attack.t1059.001 attack.g0046 detection.emerging_threats ·
Share on:

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Read More
Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity

Nov 28, 2023 · attack.execution attack.g0046 detection.emerging_threats ·
Share on:

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

Read More
Potential APT FIN7 Related PowerShell Script Created

Nov 28, 2023 · attack.execution attack.g0046 detection.emerging_threats ·
Share on:

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

Read More
Potential APT Mustang Panda Activity Against Australian Gov

Nov 28, 2023 · attack.execution attack.g0129 detection.emerging_threats ·
Share on:

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

Read More
Potential POWERTRASH Script Execution

Nov 28, 2023 · attack.execution attack.t1059.001 attack.g0046 detection.emerging_threats ·
Share on:

Detects potential execution of the PowerShell script POWERTRASH

Read More
WMI Module Loaded By Non Uncommon Process

Nov 27, 2023 · attack.execution attack.t1047 ·
Share on:

Detects a WMI modules being loaded by an uncommon process

Read More
Scheduled Task Creation

Nov 27, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks in user session

Read More
Proxy Execution Via Wuauclt.EXE

Nov 15, 2023 · attack.defense_evasion attack.t1218 attack.execution ·
Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Nov 15, 2023 · detection.emerging_threats attack.execution attack.t1059 attack.initial_access attack.t1190 cve.2023.22518 ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Nov 15, 2023 · detection.emerging_threats attack.execution attack.t1059 attack.initial_access attack.t1190 cve.2023.22518 ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
Arbitrary File Download Via IMEWDBLD.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSEDGE_PROXY.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSOHTMED.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Read More
Arbitrary File Download Via MSPUB.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Read More
Arbitrary File Download Via PresentationHost.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Read More
Arbitrary File Download Via Squirrel.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Potential File Download Via MS-AppInstaller Protocol Handler

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Read More
Potentially Suspicious Electron Application CommandLine

Nov 14, 2023 · attack.execution ·
Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Read More
Process Proxy Execution Via Squirrel.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Uncommon Child Process Of Appvlp.EXE

Nov 14, 2023 · attack.t1218 attack.defense_evasion attack.execution ·
Share on:

Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file.

Read More
XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Nov 14, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

Read More
F5 BIG-IP iControl Rest API Command Execution - Webserver

Nov 14, 2023 · attack.execution attack.t1190 ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
Remote Thread Creation Via PowerShell In Potentially Suspicious Target

Nov 10, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 ·
Share on:

Detects the creation of a remote thread from a Powershell process in a potentially suspicious target process

Read More
Suspicious WmiPrvSE Child Process

Nov 10, 2023 · attack.execution attack.defense_evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Read More
smbexec.py Service Installation

Nov 10, 2023 · attack.lateral_movement attack.execution attack.t1021.002 attack.t1569.002 ·
Share on:

Detects the use of smbexec.py tool by detecting a specific service installation

Read More
Lace Tempest Cobalt Strike Download

Nov 10, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

Read More
Lace Tempest File Indicators

Nov 10, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

Read More
Lace Tempest Malware Loader Execution

Nov 10, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

Read More
Lace Tempest PowerShell Evidence Eraser

Nov 10, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·
Share on:

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

Read More
Lace Tempest PowerShell Launcher

Nov 10, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·
Share on:

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

Read More
Execute Code with Pester.bat

Nov 9, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Csc.EXE Execution Form Potentially Suspicious Parent

Nov 6, 2023 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense_evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
HackTool - CrackMapExec Execution Patterns

Nov 6, 2023 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
Potentially Suspicious Cabinet File Expansion

Nov 6, 2023 · attack.execution attack.t1218 ·
Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Read More
Weak or Abused Passwords In CLI

Nov 6, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

Read More
Uncommon PowerShell Hosts

Nov 3, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
AADInternals PowerShell Cmdlets Execution - PsScript

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
Change PowerShell Policies to an Insecure Level - PowerShell

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects use of Set-ExecutionPolicy to set insecure policies

Read More
ImagingDevices Unusual Parent/Child Processes

Nov 2, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Nov 2, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

Nov 2, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Read More
Invoke-Obfuscation Via Use MSHTA - PowerShell Module

Nov 2, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Lolbin Defaultpack.exe Use As Proxy

Nov 2, 2023 · attack.t1218 attack.defense_evasion attack.execution ·
Share on:

Detect usage of the "defaultpack.exe" binary as a proxy to launch other programs

Read More
Net WebClient Casing Anomalies

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Read More
Perl Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Read More
Php Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Read More
Potential RDP Session Hijacking Activity

Nov 2, 2023 · attack.execution ·
Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Read More
Powershell Inline Execution From A File

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects inline execution of PowerShell code from a file

Read More
PowerShell Remote Session Creation

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

Read More
PowerShell Web Download

Nov 2, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects suspicious ways to download files or content using PowerShell

Read More
Ruby Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Read More
Suspicious Execution of Powershell with Base64

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Commandline to launch powershell with a base64 payload

Read More
Suspicious Execution via macOS Script Editor

Nov 2, 2023 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Suspicious PowerShell Encoded Command Patterns

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Read More
Suspicious PowerShell Invocations - Generic - PowerShell Module

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific - PowerShell Module

Nov 2, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Use of Pcalua For Execution

Nov 2, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Read More
BloodHound Collection Files

Oct 28, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Read More
Diskshadow Script Mode - Execution From Potential Suspicious Location

Oct 28, 2023 · attack.execution attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Read More
Malicious PowerShell Keywords

Oct 28, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects keywords from well-known PowerShell exploitation frameworks

Read More
Potential Suspicious Mofcomp Execution

Oct 28, 2023 · attack.execution attack.t1218 ·
Share on:

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

Read More
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Oct 28, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf) by Wscript/Cscript

Read More
Dump Ntds.dit To Suspicious Location

Oct 28, 2023 · attack.execution ·
Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location

Read More
MSI Installation From Suspicious Locations

Oct 28, 2023 · attack.execution ·
Share on:

Detects MSI package installation from suspicious locations

Read More
Diamond Sleet APT File Creation Indicators

Oct 28, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects file creation activity that is related to Diamond Sleet APT activity

Read More
Diamond Sleet APT Process Activity Indicators

Oct 28, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects process creation activity indicators related to Diamond Sleet APT

Read More
Diamond Sleet APT Scheduled Task Creation

Oct 28, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 detection.emerging_threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Onyx Sleet APT File Creation Indicators

Oct 28, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects file creation activity that is related to Onyx Sleet APT activity

Read More
Nslookup PowerShell Download Cradle

Oct 28, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

Read More
PowerShell Called from an Executable Version Mismatch

Oct 28, 2023 · attack.defense_evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell called from an executable by the version mismatch method

Read More
PowerShell Downgrade Attack - PowerShell

Oct 28, 2023 · attack.defense_evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Read More
Remote PowerShell Session (PS Classic)

Oct 28, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·
Share on:

Detects remote PowerShell sessions

Read More
Renamed Powershell Under Powershell Channel

Oct 28, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects renamed powershell

Read More
Suspicious Non PowerShell WSMAN COM Provider

Oct 28, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.003 ·
Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Read More
Suspicious PowerShell Download

Oct 28, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious XOR Encoded PowerShell Command Line - PowerShell

Oct 28, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell process which includes bxor command, alternative obfuscation method to b64 encoded commands.

Read More
Potentially Suspicious Child Process Of VsCode

Oct 28, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Read More
Linux HackTool Execution

Oct 28, 2023 · attack.execution attack.resource_development attack.t1587 ·
Share on:

Detects known hacktool execution based on image name.

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Oct 26, 2023 · attack.execution attack.privilege_escalation attack.resource_development attack.t1587 cve.2021.1675 detection.emerging_threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
CVE-2021-26858 Exchange Exploitation

Oct 26, 2023 · attack.t1203 attack.execution cve.2021.26858 detection.emerging_threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

Read More
CVE-2021-44077 POC Default Dropped File

Oct 26, 2023 · attack.execution cve.2021.44077 detection.emerging_threats ·
Share on:

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

Read More
DarkGate - Autoit3.EXE Execution Parameters

Oct 26, 2023 · attack.execution attack.t1059 detection.emerging_threats ·
Share on:

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Read More
DarkGate - Autoit3.EXE File Creation By Uncommon Process

Oct 26, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 detection.emerging_threats ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
MSMQ Corrupted Packet Encountered

Oct 26, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

Read More
Turla Group Named Pipes

Oct 26, 2023 · attack.g0010 attack.execution attack.t1106 detection.emerging_threats ·
Share on:

Detects a named pipe used by Turla group samples

Read More
Alternate PowerShell Hosts Pipe

Oct 23, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
File Download From IP Based URL Via CertOC.EXE

Oct 23, 2023 · attack.command_and_control attack.execution attack.t1105 ·
Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Read More
File Download From IP URL Via Curl.EXE

Oct 23, 2023 · attack.execution ·
Share on:

Detects file downloads directly from IP address URL using curl.exe

Read More
Suspicious File Download From IP Via Curl.EXE

Oct 23, 2023 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Read More
PowerShell Script Execution Policy Enabled

Oct 18, 2023 · attack.execution ·
Share on:

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Read More
Abusable DLL Potential Sideloading From Suspicious Location

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Read More
Add Windows Capability Via PowerShell Cmdlet

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
Adwind RAT / JRAT

Oct 18, 2023 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging_threats ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Adwind RAT / JRAT File Artifact

Oct 18, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Antivirus Hacktool Detection

Oct 18, 2023 · attack.execution attack.t1204 ·
Share on:

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool

Read More
APT29 2018 Phishing Campaign CommandLine Indicators

Oct 18, 2023 · attack.execution attack.t1218.011 detection.emerging_threats ·
Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Read More
Azure Kubernetes CronJob

Oct 18, 2023 · attack.persistence attack.t1053.003 attack.privilege_escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Bad Opsec Powershell Code Artifacts

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

Read More
ConvertTo-SecureString Cmdlet Usage Via CommandLine

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Read More
Cscript/Wscript Uncommon Script Extension Execution

Oct 18, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Read More
CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Oct 18, 2023 · detection.emerging_threats attack.execution attack.t1203 cve.2023.38331 ·
Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Read More
DotNet CLR DLL Loaded By Scripting Applications

Oct 18, 2023 · attack.execution attack.privilege_escalation attack.t1055 ·
Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Read More
Elevated System Shell Spawned

Oct 18, 2023 · attack.privilege_escalation attack.defense_evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges.

Read More
Exchange PowerShell Snap-Ins Usage

Oct 18, 2023 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·
Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Read More
File Decryption Using Gpg4win

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of Gpg4win to decrypt files

Read More
File Encryption Using Gpg4win

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt files

Read More
File Encryption/Decryption Via Gpg4win From Suspicious Locations

Oct 18, 2023 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Read More
File With Uncommon Extension Created By An Office Application

Oct 18, 2023 · attack.t1204.002 attack.execution ·
Share on:

Detects the creation of files with an executable or script extension by an Office application.

Read More
HackTool - Bloodhound/Sharphound Execution

Oct 18, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

Read More
HackTool - CrackMapExec PowerShell Obfuscation

Oct 18, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027.005 ·
Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Read More
HackTool - PCHunter Execution

Oct 18, 2023 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·
Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More
HackTool - Stracciatella Execution

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1059 attack.t1562.001 ·
Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Read More
Hermetic Wiper TG Process Patterns

Oct 18, 2023 · attack.execution attack.lateral_movement attack.t1021.001 detection.emerging_threats ·
Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Read More
Invoke-Obfuscation CLIP+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation STDIN+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - Powershell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - Powershell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - Powershell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Malicious Base64 Encoded PowerShell Keywords in Command Lines

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Read More
Malicious ShellIntel PowerShell Commandlets

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects Commandlet names from ShellIntel exploitation scripts.

Read More
Mint Sandstorm - AsperaFaspex Suspicious Process Execution

Oct 18, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Read More
Mint Sandstorm - ManageEngine Suspicious Process Execution

Oct 18, 2023 · attack.execution detection.emerging_threats ·
Share on:

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Read More
Non Interactive PowerShell Process Spawned

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Read More
OMIGOD HTTP No Authentication RCE

Oct 18, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.lateral_movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
Potential Baby Shark Malware Activity

Oct 18, 2023 · attack.execution attack.defense_evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging_threats ·
Share on:

Detects activity that could be related to Baby Shark malware

Read More
Potential CommandLine Path Traversal Via Cmd.EXE

Oct 18, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Read More
Potential Compromised 3CXDesktopApp Execution

Oct 18, 2023 · attack.defense_evasion attack.t1218 attack.execution detection.emerging_threats ·
Share on:

Detects execution of known compromised version of 3CXDesktopApp

Read More
Potential Data Exfiltration Activity Via CommandLine Tools

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Read More
Potential Encoded PowerShell Patterns In CommandLine

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Read More
Potential Netcat Reverse Shell Execution

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

Read More
Potential Perl Reverse Shell Execution

Oct 18, 2023 · attack.execution ·
Share on:

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

Read More
Potential PowerShell Command Line Obfuscation

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1027 attack.t1059.001 ·
Share on:

Detects the PowerShell command lines with special characters

Read More
Potential PowerShell Obfuscation Via Reversed Commands

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Read More
Potential Powershell ReverseShell Connection

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Read More
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Oct 18, 2023 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Potential SquiblyTwo Technique Execution

Oct 18, 2023 · attack.defense_evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
Potential Suspicious PowerShell Keywords

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Read More
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Oct 18, 2023 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Read More
Potentially Suspicious Child Process Of WinRAR.EXE

Oct 18, 2023 · attack.execution attack.t1203 ·
Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Read More
Potentially Suspicious WebDAV LNK Execution

Oct 18, 2023 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
PowerShell ADRecon Execution

Oct 18, 2023 · attack.discovery attack.execution attack.t1059.001 ·
Share on:

Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

Read More
PowerShell Base64 Encoded FromBase64String Cmdlet

Oct 18, 2023 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Read More
PowerShell Base64 Encoded IEX Cmdlet

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

Read More
PowerShell Base64 Encoded Invoke Keyword

Oct 18, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Read More
PowerShell Core DLL Loaded By Non PowerShell Process

Oct 18, 2023 · attack.t1059.001 attack.execution ·
Share on:

Detects loading of essential DLLs used by PowerShell, but not by the process powershell.exe. Detects behaviour similar to meterpreter's "load powershell" extension.

Read More
PowerShell Download Pattern

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects a Powershell process that contains download commands in its command line string

Read More
PUA - AdvancedRun Execution

Oct 18, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - NSudo Execution

Oct 18, 2023 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NSudo tool for command execution

Read More
Python Inline Command Execution

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Read More
Python Spawning Pretty TTY

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects python spawning a pretty tty which could be indicative of potential reverse shell activity

Read More
Qakbot Uninstaller Execution

Oct 18, 2023 · detection.emerging_threats attack.execution ·
Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Read More
Remote PowerShell Session (Network)

Oct 18, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·
Share on:

Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account.

Read More
Rundll32 Internet Connection

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 attack.execution ·
Share on:

Detects a rundll32 that communicates with public IP addresses

Read More
Script Interpreter Execution From Suspicious Folder

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Read More
Sofacy Trojan Loader Activity

Oct 18, 2023 · attack.defense_evasion attack.execution attack.g0007 attack.t1059.003 attack.t1218.011 car.2013-10-002 detection.emerging_threats ·
Share on:

Detects Trojan loader activity as used by APT28

Read More
Start Windows Service Via Net.EXE

Oct 18, 2023 · attack.execution attack.t1569.002 ·
Share on:

Detects the usage of the "net.exe" command to start a service using the "start" flag

Read More
Suspicious Child Process Of BgInfo.EXE

Oct 18, 2023 · attack.execution attack.t1059.005 attack.defense_evasion attack.t1218 attack.t1202 ·
Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Suspicious Csi.exe Usage

Oct 18, 2023 · attack.execution attack.t1072 attack.defense_evasion attack.t1218 ·
Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Read More
Suspicious Electron Application Child Processes

Oct 18, 2023 · attack.execution ·
Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

Read More
Suspicious Encoded PowerShell Command Line

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Read More
Suspicious Execution Of PDQDeployRunner

Oct 18, 2023 · attack.execution ·
Share on:

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Read More
Suspicious Microsoft Office Child Process

Oct 18, 2023 · attack.defense_evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Suspicious Mshta.EXE Execution Patterns

Oct 18, 2023 · attack.execution attack.t1106 ·
Share on:

Detects suspicious mshta process execution patterns

Read More
Suspicious Outlook Child Process

Oct 18, 2023 · attack.execution attack.t1204.002 ·
Share on:

Detects a suspicious process spawning from an Outlook process.

Read More
Suspicious PowerShell Parent Process

Oct 18, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Read More
Suspicious Program Names

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Read More
Suspicious Remote Child Process From Outlook

Oct 18, 2023 · attack.execution attack.t1059 attack.t1202 ·
Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Read More
Suspicious Scripting in a WMI Consumer

Oct 18, 2023 · attack.execution attack.t1059.005 ·
Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read More
Suspicious WindowsTerminal Child Processes

Oct 18, 2023 · attack.execution attack.persistence ·
Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Read More
Suspicious WSMAN Provider Image Loads

Oct 18, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.003 ·
Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Read More
Suspicious XOR Encoded PowerShell Command

Oct 18, 2023 · attack.defense_evasion attack.execution attack.t1059.001 attack.t1140 attack.t1027 ·
Share on:

Detects presence of a potentially xor encoded powershell command

Read More
Tasks Folder Evasion

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.execution attack.t1574.002 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Turla Group Lateral Movement

Oct 18, 2023 · attack.g0010 attack.execution attack.t1059 attack.lateral_movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging_threats ·
Share on:

Detects automated lateral movement by Turla group

Read More
UNC2452 Process Creation Patterns

Oct 18, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·
Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

Read More
VMToolsd Suspicious Child Process

Oct 18, 2023 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Read More
Windows Shell/Scripting Application File Write to Suspicious Folder

Oct 18, 2023 · attack.execution attack.t1059 ·
Share on:

Detects Windows shells and scripting applications that write files to suspicious folders

Read More
Windows Shell/Scripting Processes Spawning Suspicious Programs

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·
Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Read More
AMSI Bypass Pattern Assembly GetType

Oct 17, 2023 · attack.defense_evasion attack.t1562.001 attack.execution ·
Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Read More
Arbitrary Shell Command Execution Via Settingcontent-Ms

Oct 17, 2023 · attack.t1204 attack.t1566.001 attack.execution attack.initial_access ·
Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Read More
Atlassian Confluence CVE-2022-26134

Oct 17, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2022.26134 ·
Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Read More
Audit CVE Event

Oct 17, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
AWS EC2 Startup Shell Script Change

Oct 17, 2023 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·
Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Read More
Azure New CloudShell Created

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

Identifies when a new cloudshell is created inside of Azure portal.

Read More
Base64 MZ Header In CommandLine

Oct 17, 2023 · attack.execution ·
Share on:

Detects encoded base64 MZ header in the commandline

Read More
BPFDoor Abnormal Process ID or Lock File Accessed

Oct 17, 2023 · attack.execution attack.t1106 attack.t1059 ·
Share on:

detects BPFDoor .lock and .pid files access in temporary file storage facility

Read More
Change PowerShell Policies to an Insecure Level

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects use of executionpolicy option to set insecure policies

Read More
Conhost.exe CommandLine Path Traversal

Oct 17, 2023 · attack.execution attack.t1059.003 ·
Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Read More
Created Files by Microsoft Sync Center

Oct 17, 2023 · attack.t1055 attack.t1218 attack.execution attack.defense_evasion ·
Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Read More
Credential Dumping Tools Service Execution - System

Oct 17, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
DNS Events Related To Mining Pools

Oct 17, 2023 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·
Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Read More
Equation Editor Network Connection

Oct 17, 2023 · attack.execution attack.t1203 ·
Share on:

Detects network connections from Equation Editor

Read More
Excel Network Connections

Oct 17, 2023 · attack.execution attack.t1203 ·
Share on:

Detects an Excel process that opens suspicious network connections to non-private IP addresses, and attempts to cover CVE-2021-42292. You will likely have to tune this rule for your organization, but it is certainly something you should look for and could have applications for malicious activity beyond CVE-2021-42292.

Read More
Execute Code with Pester.bat as Parent

Oct 17, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute MSDT Via Answer File

Oct 17, 2023 · attack.defense_evasion attack.t1218 attack.execution ·
Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Read More
Execute Pcwrun.EXE To Leverage Follina

Oct 17, 2023 · attack.defense_evasion attack.t1218 attack.execution ·
Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Read More
Execution of Powershell Script in Public Folder

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Read More
Invoke-Obfuscation Via Use Rundll32 - PowerShell

Oct 17, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module

Oct 17, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Loading Diagcab Package From Remote Path

Oct 17, 2023 · attack.execution ·
Share on:

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

Read More
Metasploit Or Impacket Service Installation Via SMB PsExec

Oct 17, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Read More
Microsoft Sync Center Suspicious Network Connections

Oct 17, 2023 · attack.t1055 attack.t1218 attack.execution attack.defense_evasion ·
Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Read More
MSI Installation From Web

Oct 17, 2023 · attack.execution attack.t1218 attack.t1218.007 ·
Share on:

Detects installation of a remote msi file from web.

Read More
MSSQL XPCmdshell Option Change

Oct 17, 2023 · attack.execution ·
Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed

Read More
MSSQL XPCmdshell Suspicious Execution

Oct 17, 2023 · attack.execution ·
Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

Read More
Nohup Execution

Oct 17, 2023 · attack.execution attack.t1059.004 ·
Share on:

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Read More
PAExec Service Installation

Oct 17, 2023 · attack.execution attack.t1569.002 ·
Share on:

Detects PAExec service installation

Read More
Parent in Public Folder Suspicious Process

Oct 17, 2023 · attack.defense_evasion attack.execution attack.t1564 attack.t1059 ·
Share on:

This rule detects suspicious processes with parent images located in the C:\Users\Public folder

Read More
Payload Decoded and Decrypted via Built-in Utilities

Oct 17, 2023 · attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense_evasion attack.s0482 attack.s0402 ·
Share on:

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Read More
Potential Binary Impersonating Sysinternals Tools

Oct 17, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·
Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection

Read More
Powershell MsXml COM Object

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Read More
PowerShell Script Run in AppData

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

Read More
PSAsyncShell - Asynchronous TCP Reverse Shell

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell

Read More
Python Spawning Pretty TTY on Windows

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

Detects python spawning a pretty tty

Read More
Renamed PsExec Service Execution

Oct 17, 2023 · attack.execution ·
Share on:

Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

Read More
Rundll32 UNC Path Execution

Oct 17, 2023 · attack.defense_evasion attack.execution attack.t1021.002 attack.t1218.011 ·
Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

Read More
Schtasks From Suspicious Folders

Oct 17, 2023 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
Script Event Consumer Spawning Process

Oct 17, 2023 · attack.execution attack.t1047 ·
Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Read More
Sliver C2 Default Service Installation

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
Suspicious Add Scheduled Task Parent

Oct 17, 2023 · attack.execution attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creations from a parent stored in a temporary folder

Read More
Suspicious Application Installed

Oct 17, 2023 · attack.execution ·
Share on:

Detects suspicious application installed by looking at the added shortcut to the app resolver cache

Read More
Suspicious Cmdl32 Execution

Oct 17, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·
Share on:

lolbas Cmdl32 is use to download a payload to evade antivirus

Read More
Suspicious Interactive PowerShell as SYSTEM

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Read More
Suspicious Java Children Processes

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

Detects java process spawning suspicious children

Read More
Suspicious Modification Of Scheduled Tasks

Oct 17, 2023 · attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious PowerShell Download - Powershell Script

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download and Execute Pattern

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Read More
Suspicious PowerShell IEX Execution Patterns

Oct 17, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Read More
Suspicious Scheduled Task Creation

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Name As GUID

Oct 17, 2023 · attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Scheduled Task Update

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious Schtasks Execution AppData Folder

Oct 17, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Oct 17, 2023 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Oct 17, 2023 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious Script Execution From Temp Folder

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script executions from temporary folder

Read More
UAC Bypass Using IDiagnostic Profile

Oct 17, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IDiagnostic Profile - File

Oct 17, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·
Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Read More
Use of Forfiles For Execution

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

Execute commands and binaries from the context of "forfiles". This is used as a LOLBIN for example to bypass application whitelisting.

Read More
Use of FSharp Interpreters

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

The FSharp Interpreters, FsiAnyCpu.exe and FSi.exe, can be used for AWL bypass and is listed in Microsoft recommended block rules.

Read More
Use of OpenConsole

Oct 17, 2023 · attack.execution attack.t1059 ·
Share on:

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Read More
Use of Scriptrunner.exe

Oct 17, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting

Read More
Use Of The SFTP.EXE Binary As A LOLBIN

Oct 17, 2023 · attack.defense_evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag

Read More
Wab Execution From Non Default Location

Oct 17, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

Read More
Wab/Wabmig Unusual Parent Or Child Processes

Oct 17, 2023 · attack.defense_evasion attack.execution ·
Share on:

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

Read More
Windows Defender Exclusions Added - PowerShell

Oct 17, 2023 · attack.defense_evasion attack.t1562 attack.execution attack.t1059 ·
Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Read More
WMIC Unquoted Services Path Lookup - PowerShell

Oct 17, 2023 · attack.execution attack.t1047 ·
Share on:

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

Read More
WScript or CScript Dropper - File

Oct 17, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe

Read More
Wusa Extracting Cab Files

Oct 17, 2023 · attack.execution ·
Share on:

Detects usage of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument which is not longer supported. This could indicate an attacker using an old technique

Read More
CVE-2021-1675 Print Spooler Exploitation IPC Access

Oct 15, 2023 · attack.execution attack.t1569 cve.2021.1675 cve.2021.34527 detection.emerging_threats ·
Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Read More
Possible CVE-2021-1675 Print Spooler Exploitation

Oct 15, 2023 · attack.execution attack.t1569 cve.2021.1675 detection.emerging_threats ·
Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Read More
Potential Bumblebee Remote Thread Creation

Oct 15, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 detection.emerging_threats ·
Share on:

Detects remote thread injection events based on action seen used by bumblebee

Read More
Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
DarkGate Autoit3.exe Execution Parameters

Oct 14, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of the legitimate Autoit3 utility from a suspect parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Read More
AWS IAM S3Browser LoginProfile Creation

Oct 12, 2023 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Oct 12, 2023 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Oct 12, 2023 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
Google Cloud Kubernetes CronJob

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Renamed CURL.EXE Execution

Oct 12, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Read More
Control Panel Items

Oct 12, 2023 · attack.execution attack.defense_evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Oct 12, 2023 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges