attack.initial_access | Detection.FYI

Exploitation of Vulnerable VMware Horizon to LOG4J

Aug 10, 2024 · attack.initial_access attack.t1190 ·
Share on:

Detecting initial exploitation attempt against VMware Horizon deployments running vulnerable versions of Log4j.

Read More
WScript Spawned from a Browser Making External Network Connections

Mar 26, 2024 · attack.initial_access attack.t1189 ·
Share on:

While JavaScript is everywhere on the web, it is rather unusual for the browser to download a JavaScript file and execute it via the Windows Script Host (wscript.exe). When this downloaded script starts communicating with devices outside of your network, things get even more suspicious. That said, this detection analytic may be noisy in some environments, so be prepared to identify what scripts are normally run in this way to tune out the noise. Part of the RedCanary 2024 Threat Detection Report.

Read More
Exchange Webshell creation

Feb 23, 2024 · attack.t1505.003 attack.persistence attack.t1190 attack.initial_access ·
Share on:

These commands were used to create a webshell by exploiting ProxyShell vulnerabilities

Read More
Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·
Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Read More
Search-ms and WebDAV Indicators in URL

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·
Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaign.

Read More
WebDAV Temporary Local File Creation

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·
Share on:

Detects the creation of WebDAV temporary files with suspicious extensions

Read More
Yellow Cockatoo Powershell Startup Folder Persistence (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·
Share on:

Detects .lnk files created by Powershell in the startup folder. Associated with (but not unique to) Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Read More
Yellow Cockatoo PowerShell Suspicious .NET Methods (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·
Share on:

Detects suspicious Powershell script load contents associated with Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Read More
Disabled Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple disabled domain accounts from a single source system using the Kerberos protocol.

Read More
Invalid Users Failing To Authenticate From Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.

Read More
Invalid Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the Kerberos protocol.

Read More
Multiple Suspicious Resp Codes Caused by Single Client

Apr 21, 2023 · attack.initial_access attack.t1190 ·
Share on:

Detects possible exploitation activity or bugs in a web application

Read More
Multiple Users Failing to Authenticate from Single Process

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple accounts from a single process on the system.

Read More
Multiple Users Remotely Failing To Authenticate From Single Source

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects a source system failing to authenticate against a remote host with multiple users.

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Password Spraying via Explicit Credentials

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects a single user failing to authenticate to multiple users using explicit credentials.

Read More
Possible DNS Rebinding

Apr 21, 2023 · attack.initial_access attack.t1189 ·
Share on:

Detects several different DNS-answers by one domain with IPs from internal and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved in host cache for a while TTL).

Read More
Valid Users Failing to Authenticate From Single Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.

Read More
Valid Users Failing to Authenticate from Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·
Share on:

Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.

Read More
External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Read More
Suspicious Commands by SQL Server

Jan 8, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious commands created from sqlservr process.

Read More
ISO Image Mount

Dec 28, 2022 · attack.initial_access attack.t1566.001 ·
Share on:

Detects the mount of ISO images on an endpoint

Read More
Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·
Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Read More