attack.g0069 | Detection.FYI

CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
CMSTP Execution Process Access

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 attack.execution attack.t1559.001 attack.g0069 attack.g0080 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Process Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
MERCURY APT Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0069 detection.emerging-threats ·
Share on:

Detects suspicious command line patterns seen being used by MERCURY APT

Read More
Potential MuddyWater APT Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.g0069 detection.emerging-threats ·
Share on:

Detects potential Muddywater APT activity

Read More