attack.impact

Github Delete Action Invoked

Dec 1, 2023 · attack.impact attack.collection attack.t1213.003 ·

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Github Self Hosted Runner Changes Detected

Dec 1, 2023 · attack.impact attack.discovery attack.collection attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Potential Active Directory Enumeration Using AD Module - ProcCreation

Dec 1, 2023 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Potential Active Directory Enumeration Using AD Module - PsModule

Dec 1, 2023 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Potential Active Directory Enumeration Using AD Module - PsScript

Dec 1, 2023 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Renamed Sysinternals Sdelete Execution

Dec 1, 2023 · attack.impact attack.t1485 ·

Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Load Of RstrtMgr.DLL By A Suspicious Process

Nov 28, 2023 · attack.impact attack.defense_evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Load Of RstrtMgr.DLL By An Uncommon Process

Nov 28, 2023 · attack.impact attack.defense_evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Suspicious Appended Extension

Nov 15, 2023 · attack.impact attack.t1486 ·

Share on:

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Portable Gpg.EXE Execution

Nov 10, 2023 · attack.impact attack.t1486 ·

Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

AADInternals PowerShell Cmdlets Execution - ProccessCreation

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

AADInternals PowerShell Cmdlets Execution - PsScript

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Deletion of Volume Shadow Copies via WMI with PowerShell

Nov 2, 2023 · attack.impact attack.t1490 ·

Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Group Has Been Deleted Via Groupdel

Nov 2, 2023 · attack.impact attack.t1531 ·

Share on:

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

User Has Been Deleted Via Userdel

Nov 2, 2023 · attack.impact attack.t1531 ·

Share on:

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

AWS S3 Bucket Versioning Disable

Oct 28, 2023 · attack.impact attack.t1490 ·

Share on:

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Delete All Scheduled Tasks

Oct 28, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Delete Volume Shadow Copies Via WMI With PowerShell

Oct 28, 2023 · attack.impact attack.t1490 ·

Share on:

Shadow Copies deletion using operating systems utilities via PowerShell

BlueSky Ransomware Artefacts

Oct 26, 2023 · attack.impact attack.t1486 detection.emerging_threats ·

Share on:

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

Application Uninstalled

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

An application has been removed. Check if it is critical.

Boot Configuration Tampering Via Bcdedit.EXE

Oct 18, 2023 · attack.impact attack.t1490 ·

Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

History File Deletion

Oct 18, 2023 · attack.impact attack.t1565.001 ·

Share on:

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

Stop Windows Service Via Net.EXE

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service

Stop Windows Service Via PowerShell Stop-Service

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service

Stop Windows Service Via Sc.EXE

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service

Suspicious Volume Shadow Copy Vssapi.dll Load

Oct 18, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

Suspicious Volume Shadow Copy Vsstrace.dll Load

Oct 18, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

WannaCry Ransomware Activity

Oct 18, 2023 · attack.lateral_movement attack.t1210 attack.discovery attack.t1083 attack.defense_evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging_threats ·

Share on:

Detects WannaCry ransomware activity

Audit CVE Event

Oct 17, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Azure Application Gateway Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a application gateway is modified or deleted.

Azure Application Security Group Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a application security group is modified or deleted.

Azure Container Registry Created or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Detects when a Container Registry is created or deleted.

Azure DNS Zone Modified or Deleted

Oct 17, 2023 · attack.impact attack.t1565.001 ·

Share on:

Identifies when DNS zone is modified or deleted.

Azure Firewall Modified or Deleted

Oct 17, 2023 · attack.impact attack.defense_evasion attack.t1562.004 ·

Share on:

Identifies when a firewall is created, modified, or deleted.

Azure Firewall Rule Collection Modified or Deleted

Oct 17, 2023 · attack.impact attack.defense_evasion attack.t1562.004 ·

Share on:

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Azure Firewall Rule Configuration Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a Firewall Rule Configuration is Modified or Deleted.

Azure Key Vault Modified or Deleted

Oct 17, 2023 · attack.impact attack.credential_access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when a key vault is modified or deleted.

Azure Keyvault Key Modified or Deleted

Oct 17, 2023 · attack.impact attack.credential_access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when a Keyvault Key is modified or deleted in Azure.

Azure Keyvault Secrets Modified or Deleted

Oct 17, 2023 · attack.impact attack.credential_access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when secrets are modified or deleted in Azure.

Azure Kubernetes Cluster Created or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Azure Kubernetes Network Policy Change

Oct 17, 2023 · attack.impact attack.credential_access ·

Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Azure Kubernetes Pods Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies the deletion of Azure Kubernetes Pods.

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Oct 17, 2023 · attack.impact attack.credential_access ·

Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Azure Kubernetes Secret or Config Object Access

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Azure Kubernetes Sensitive Role Access

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Azure Kubernetes Service Account Modified or Deleted

Oct 17, 2023 · attack.impact attack.t1531 ·

Share on:

Identifies when a service account is modified or deleted.

Azure Network Firewall Policy Modified or Deleted

Oct 17, 2023 · attack.impact attack.defense_evasion attack.t1562.007 ·

Share on:

Identifies when a Firewall Policy is Modified or Deleted.

Azure Network Security Configuration Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a network security configuration is modified or deleted.

Azure Point-to-site VPN Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a Point-to-site VPN is Modified or Deleted.

Azure Suppression Rule Created

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

Azure Virtual Network Device Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

Azure Virtual Network Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a Virtual Network is modified or deleted in Azure.

Azure VPN Connection Modified or Deleted

Oct 17, 2023 · attack.impact ·

Share on:

Identifies when a VPN connection is modified or deleted.

DD File Overwrite

Oct 17, 2023 · attack.impact attack.t1485 ·

Share on:

Detects potential overwriting and deletion of a file using DD.

Delete Important Scheduled Task

Oct 17, 2023 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script

Oct 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Disable Important Scheduled Task

Oct 17, 2023 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

DNS Events Related To Mining Pools

Oct 17, 2023 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·

Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Sensitive Registry Access via Volume Shadow Copy

Oct 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects a command that accesses password storing registry hives via volume shadow backups

Suspicious Execution of Shutdown to Log Out

Oct 17, 2023 · attack.impact attack.t1529 ·

Share on:

Detects the rare use of the command line tool shutdown to logoff a user

Suspicious Reg Add BitLocker

Oct 17, 2023 · attack.impact attack.t1486 ·

Share on:

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Activity Performed by Terminated User

Oct 12, 2023 · attack.impact ·

Share on:

Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.

AWS EC2 Disable EBS Encryption

Oct 12, 2023 · attack.impact attack.t1486 attack.t1565 ·

Share on:

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

AWS EFS Fileshare Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

AWS EFS Fileshare Mount Modified or Deleted

Oct 12, 2023 · attack.impact attack.t1485 ·

Share on:

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

AWS EKS Cluster Created or Deleted

Oct 12, 2023 · attack.impact attack.t1485 ·

Share on:

Identifies when an EKS cluster is created or deleted.

AWS ElastiCache Security Group Modified or Deleted

Oct 12, 2023 · attack.impact attack.t1531 ·

Share on:

Identifies when an ElastiCache security group has been modified or deleted.

Azure Application Credential Modified

Oct 12, 2023 · attack.impact ·

Share on:

Identifies when a application credential is modified.

Azure Application Deleted

Oct 12, 2023 · attack.defense_evasion attack.impact attack.t1489 ·

Share on:

Identifies when a application is deleted in Azure.

Azure Device No Longer Managed or Compliant

Oct 12, 2023 · attack.impact ·

Share on:

Identifies when a device in azure is no longer managed or compliant

Azure Device or Configuration Modified or Deleted

Oct 12, 2023 · attack.impact attack.t1485 attack.t1565.001 ·

Share on:

Identifies when a device or device configuration in azure is modified or deleted.

Google Cloud DNS Zone Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Identifies when a DNS Zone is modified or deleted in Google Cloud.

Google Cloud Re-identifies Sensitive Information

Oct 12, 2023 · attack.impact attack.t1565 ·

Share on:

Identifies when sensitive information is re-identified in google Cloud.

Google Cloud Service Account Disabled or Deleted

Oct 12, 2023 · attack.impact attack.t1531 ·

Share on:

Identifies when a service account is disabled or deleted in Google Cloud.

Google Cloud Service Account Modified

Oct 12, 2023 · attack.impact ·

Share on:

Identifies when a service account is modified in Google Cloud.

Google Cloud SQL Database Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Detect when a Cloud SQL DB has been modified or deleted.

Google Cloud Storage Buckets Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Detects when storage bucket is modified or deleted in Google Cloud.

Google Cloud VPN Tunnel Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

Google Workspace Application Removed

Oct 12, 2023 · attack.impact ·

Share on:

Detects when an an application is removed from Google Workspace.

Google Workspace MFA Disabled

Oct 12, 2023 · attack.impact ·

Share on:

Detects when multi-factor authentication (MFA) is disabled.

Google Workspace Role Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Detects when an a role is modified or deleted in Google Workspace.

Google Workspace Role Privilege Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Detects when an a role privilege is deleted in Google Workspace.

Microsoft 365 - Potential Ransomware Activity

Oct 12, 2023 · attack.impact attack.t1486 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Microsoft 365 - Unusual Volume of File Deletion

Oct 12, 2023 · attack.impact attack.t1485 ·

Share on:

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Windows Update Error

Oct 4, 2023 · attack.impact attack.resource_development attack.t1584 ·

Share on:

Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KB aren't installed.

Fsutil Suspicious Invocation

Sep 10, 2023 · attack.defense_evasion attack.impact attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Linux Crypto Mining Indicators

Aug 28, 2023 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Linux Crypto Mining Pool Connections

Aug 28, 2023 · attack.impact attack.t1496 ·

Share on:

Detects process connections to a Monero crypto mining pool

Potential BlackByte Ransomware Activity

Aug 28, 2023 · detection.emerging_threats attack.execution attack.defense_evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 ·

Share on:

Detects command line patterns used by BlackByte ransomware in different operations

New Root or CA or AuthRoot Certificate to Store

Aug 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

Potential Ransomware Activity Using LegalNotice Message

Aug 17, 2023 · attack.impact attack.t1491.001 ·

Share on:

Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages

Registry Disable System Restore

Aug 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects the modification of the registry to disable a system restore on the computer

Renamed Gpg.EXE Execution

Aug 9, 2023 · attack.impact attack.t1486 ·

Share on:

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

LockerGoga Ransomware Activity

Jun 20, 2023 · attack.impact attack.t1486 detection.emerging_threats ·

Share on:

Detects LockerGoga ransomware activity via specific command line.

Potential Conti Ransomware Activity

Jun 20, 2023 · attack.impact attack.s0575 attack.t1486 detection.emerging_threats ·

Share on:

Detects a specific command used by the Conti ransomware group

Potential Dtrack RAT Activity

Jun 20, 2023 · attack.impact attack.t1490 detection.emerging_threats ·

Share on:

Detects potential Dtrack RAT activity via specific process patterns

Potential Maze Ransomware Activity

Jun 20, 2023 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging_threats ·

Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Amsi.DLL Load By Uncommon Process

Jun 1, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects loading of Amsi.dll by uncommon processes

Potential Suspicious Change To Sensitive/Critical Files

May 30, 2023 · attack.impact attack.t1565.001 ·

Share on:

Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.

Suspicious Volume Shadow Copy VSS_PS.dll Load

May 23, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of vss_ps.dll by uncommon executables

Nginx Core Dump

May 8, 2023 · attack.impact attack.t1499.004 ·

Share on:

Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.

Multiple Modsecurity Blocks

Apr 21, 2023 · attack.impact attack.t1499 ·

Share on:

Detects multiple blocks by the mod_security module (Web Application Firewall)

Suspicious Multiple File Rename Or Delete Occurred

Apr 21, 2023 · attack.impact attack.t1486 ·

Share on:

Detects multiple file rename or delete events occurrence within a specified period of time by a same user (these events may signalize about ransomware activity).

Apache Segmentation Fault

Apr 19, 2023 · attack.impact attack.t1499.004 ·

Share on:

Detects a segmentation fault error message caused by a crashing apache worker process

Network Communication With Crypto Mining Pool

Apr 18, 2023 · attack.impact attack.t1496 ·

Share on:

Detects initiated network connections to crypto mining pools

NTFS Vulnerability Exploitation

Apr 14, 2023 · attack.impact attack.t1499.001 ·

Share on:

This the exploitation of a NTFS vulnerability as reported without many details via Twitter

Silence.EDA Detection

Apr 11, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·

Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Copy From VolumeShadowCopy Via Cmd.EXE

Mar 7, 2023 · attack.impact attack.t1490 ·

Share on:

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

Potential Crypto Mining Activity

Mar 5, 2023 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Suspicious Execution of Shutdown

Mar 2, 2023 · attack.impact attack.t1529 ·

Share on:

Use of the commandline to shutdown or reboot windows

Potential File Overwrite Via Sysinternals SDelete

Feb 28, 2023 · attack.impact attack.t1485 ·

Share on:

Detects the use of SDelete to erase a file not the free space

Deleted Data Overwritten Via Cipher.EXE

Feb 22, 2023 · attack.impact attack.t1485 ·

Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Backup Files Deleted

Feb 17, 2023 · attack.impact attack.t1490 ·

Share on:

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Important Scheduled Task Deleted

Feb 8, 2023 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

SystemStateBackup Deleted Using Wbadmin.EXE

Feb 5, 2023 · attack.impact attack.t1490 ·

Share on:

Deletes the Windows systemstatebackup using wbadmin.exe. This technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled.

Commands to Clear or Remove the Syslog - Builtin

Feb 1, 2023 · attack.impact attack.t1565.001 ·

Share on:

Detects specific commands commonly used to remove or empty the syslog

Monero Crypto Coin Mining Pool Lookup

Feb 1, 2023 · attack.impact attack.t1496 attack.t1567 ·

Share on:

Detects suspicious DNS queries to Monero mining pools

Suspicious Log Entries

Feb 1, 2023 · attack.impact ·

Share on:

Detects suspicious log entries in Linux log files

Remove Account From Domain Admin Group

Jan 27, 2023 · attack.impact attack.t1531 ·

Share on:

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Replace Desktop Wallpaper by Powershell

Jan 27, 2023 · attack.impact attack.t1491.001 ·

Share on:

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper

Suspicious Creation TXT File in User Desktop

Jan 27, 2023 · attack.impact attack.t1486 ·

Share on:

Ransomware create txt file in the user Desktop

Okta User Account Locked Out

Jan 12, 2023 · attack.impact attack.t1531 ·

Share on:

Detects when an user account is locked out.

Cisco Denial of Service

Jan 4, 2023 · attack.impact attack.t1495 attack.t1529 attack.t1565.001 ·

Share on:

Detect a system being shutdown or put into different boot mode

Cisco File Deletion

Jan 4, 2023 · attack.defense_evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·

Share on:

See what files are being deleted from flash file systems

Cisco Modify Configuration

Jan 4, 2023 · attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·

Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Delete Volume Shadow Copies via WMI with PowerShell - PS Script

Jan 4, 2023 · attack.impact attack.t1490 ·

Share on:

Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Powershell Add Name Resolution Policy Table Rule

Jan 4, 2023 · attack.impact attack.t1565 ·

Share on:

Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.

OneLogin User Account Locked

Dec 27, 2022 · attack.impact ·

Share on:

Detects when an user account is locked or suspended.

OneLogin User Assumed Another User

Dec 27, 2022 · attack.impact ·

Share on:

Detects when an user assumed another user account.

Vice Society Encrypted File Extension File Creation

Nov 29, 2022 · attack.impact attack.t1486 ·

Share on:

Detects creation of potentially-encrypted files by Vice Society ransomeware. As this is based only on file extensions, the analyst should investigate surrounding activity to validate that this is not part of a benign applicatoin.