attack.initial_access

Cisco BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Cisco LDP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Github New Secret Created

Dec 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1078.004 ·

Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Github Self Hosted Runner Changes Detected

Dec 1, 2023 · attack.impact attack.discovery attack.collection attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Huawei BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Java Payload Strings

Dec 1, 2023 · cve.2022.26134 cve.2021.26084 attack.initial_access attack.t1190 ·

Share on:

Detects possible Java payloads in web access logs

Juniper BGP Missing MD5

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Outdated Dependency Or Vulnerability Alert Disabled

Dec 1, 2023 · attack.initial_access attack.t1195.001 ·

Share on:

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Dec 1, 2023 · attack.initial_access attack.t1190 cve.2022.44877 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Potential CVE-2022-26809 Exploitation Attempt

Dec 1, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1569.002 cve.2022.26809 detection.emerging_threats ·

Share on:

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Dec 1, 2023 · detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

Suspicious Shells Spawn by Java Utility Keytool

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Nov 28, 2023 · detection.emerging_threats attack.initial_access attack.t1190 cve.2023.4966 ·

Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Nov 28, 2023 · detection.emerging_threats attack.initial_access attack.t1190 cve.2023.4966 ·

Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Nov 28, 2023 · detection.emerging_threats attack.initial_access attack.t1190 cve.2023.4966 ·

Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Nov 28, 2023 · detection.emerging_threats attack.initial_access attack.t1190 cve.2023.4966 ·

Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

Exchange Exploitation Used by HAFNIUM

Nov 28, 2023 · attack.initial_access attack.t1190 attack.g0125 detection.emerging_threats ·

Share on:

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Nov 15, 2023 · detection.emerging_threats attack.execution attack.t1059 attack.initial_access attack.t1190 cve.2023.22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Nov 15, 2023 · detection.emerging_threats attack.execution attack.t1059 attack.initial_access attack.t1190 cve.2023.22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Nov 15, 2023 · detection.emerging_threats attack.initial_access attack.t1190 cve.2023.22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Nov 15, 2023 · detection.emerging_threats attack.initial_access attack.t1190 cve.2023.22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy

Nov 15, 2023 · attack.initial_access attack.t1190 cve.2023.43621 detection.emerging_threats ·

Share on:

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.

Potential Information Disclosure CVE-2023-43261 Exploitation - Web

Nov 15, 2023 · attack.initial_access attack.t1190 cve.2023.43621 detection.emerging_threats ·

Share on:

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.

Confluence Exploitation CVE-2019-3398

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2019.3398 detection.emerging_threats ·

Share on:

Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

CVE-2021-21972 VSphere Exploitation

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2021.21972 detection.emerging_threats ·

Share on:

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

CVE-2021-21978 Exploitation Attempt

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2021.21978 detection.emerging_threats ·

Share on:

Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978

CVE-2021-33766 Exchange ProxyToken Exploitation

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2021.33766 detection.emerging_threats ·

Share on:

Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766

CVE-2023-46747 Exploitation Activity - Proxy

Nov 14, 2023 · attack.initial_access attack.t1190 detection.emerging_threats cve.2023.46747 ·

Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

CVE-2023-46747 Exploitation Activity - Webserver

Nov 14, 2023 · attack.initial_access attack.t1190 detection.emerging_threats cve.2023.46747 ·

Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Exchange Exploitation CVE-2021-28480

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2021.28480 detection.emerging_threats ·

Share on:

Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480

F5 BIG-IP iControl Rest API Command Execution - Proxy

Nov 14, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Potential CVE-2022-21587 Exploitation Attempt

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2022.21587 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.

Potential OWASSRF Exploitation Attempt - Proxy

Nov 14, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Potential OWASSRF Exploitation Attempt - Webserver

Nov 14, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

ProxyLogon Reset Virtual Directories Based On IIS Log

Nov 14, 2023 · cve.2021.26858 detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

Zimbra Collaboration Suite Email Server Unauthenticated RCE

Nov 14, 2023 · attack.initial_access attack.t1190 cve.2022.27925 detection.emerging_threats ·

Share on:

Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection

ISO Image Mounted

Nov 10, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the mount of an ISO image on an endpoint

Shell Process Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Suspicious Processes Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Apache Spark Shell Command Injection - Weblogs

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2022.33891 detection.emerging_threats ·

Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective

Atlassian Bitbucket Command Injection Via Archive API

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2022.36804 detection.emerging_threats ·

Share on:

Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804

CVE-2021-41773 Exploitation Attempt

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2021.41773 detection.emerging_threats ·

Share on:

Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

CVE-2022-31656 VMware Workspace ONE Access Auth Bypass

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2022.31656 detection.emerging_threats ·

Share on:

Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

CVE-2022-31659 VMware Workspace ONE Access RCE

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2022.31659 detection.emerging_threats ·

Share on:

Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659

Log4j RCE CVE-2021-44228 in Fields

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2021.44228 detection.emerging_threats ·

Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

OWASSRF Exploitation Attempt Using Public POC - Proxy

Nov 2, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

OWASSRF Exploitation Attempt Using Public POC - Webserver

Nov 2, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Potential CVE-2022-46169 Exploitation Attempt

Nov 2, 2023 · attack.initial_access attack.t1190 cve.2022.46169 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

Rejetto HTTP File Server RCE

Nov 2, 2023 · attack.initial_access attack.t1190 attack.t1505.003 cve.2014.6287 detection.emerging_threats ·

Share on:

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Suspicious Execution via macOS Script Editor

Nov 2, 2023 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Suspicious SQL Query

Nov 2, 2023 · attack.exfiltration attack.initial_access attack.privilege_escalation attack.t1190 attack.t1505.001 ·

Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Suspicious User-Agents Related To Recon Tools

Nov 2, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects known suspicious (default) user-agents related to scanning/recon tools

Impossible Travel

Oct 28, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Use of Legacy Authentication Protocols

Oct 28, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·

Share on:

Alert on when legacy authentication has been used on an account

Okta New Admin Console Behaviours

Oct 28, 2023 · attack.initial_access attack.t1078.004 ·

Share on:

Detects when Okta identifies new activity in the Admin Console.

CVE-2020-0688 Exploitation via Eventlog

Oct 26, 2023 · attack.initial_access attack.t1190 cve.2020.0688 detection.emerging_threats ·

Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

Exploitation Indicators Of CVE-2023-20198

Oct 26, 2023 · attack.privilege_escalation attack.initial_access detection.emerging_threats ·

Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

LPE InstallerFileTakeOver PoC CVE-2021-41379

Oct 26, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Potential CVE-2023-27997 Exploitation Indicators

Oct 26, 2023 · cve.2023.27997 attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

External Remote RDP Logon from Public IP

Oct 18, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

External Remote SMB Logon from Public IP

Oct 18, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Failed Logon From Public IP

Oct 18, 2023 · attack.initial_access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·

Share on:

A login from a public IP can indicate a misconfigured firewall or network boundary.

Office Macro File Creation From Suspicious Process

Oct 18, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a office macro file from a a suspicious process

Office Macro File Download

Oct 18, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a new office macro files on the systems via an application (browser, mail client).

OMIGOD HTTP No Authentication RCE

Oct 18, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.lateral_movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·

Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Password Provided In Command Line Of Net.EXE

Oct 18, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

Potential Initial Access via DLL Search Order Hijacking

Oct 18, 2023 · attack.t1566 attack.t1566.001 attack.initial_access attack.t1574 attack.t1574.001 attack.defense_evasion ·

Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Potential MOVEit Transfer CVE-2023-34362 Exploitation

Oct 18, 2023 · attack.initial_access attack.t1190 cve.2023.34362 detection.emerging_threats ·

Share on:

Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

Successful IIS Shortname Fuzzing Scan

Oct 18, 2023 · attack.initial_access attack.t1190 ·

Share on:

When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"

Suspicious Microsoft OneNote Child Process

Oct 18, 2023 · attack.t1566 attack.t1566.001 attack.initial_access ·

Share on:

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

User Added To Admin Group Via Dscl

Oct 18, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "dscl"

User Added To Admin Group Via DseditGroup

Oct 18, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Account Disabled or Blocked for Sign in Attempts

Oct 17, 2023 · attack.initial_access attack.t1078.004 ·

Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Apache Spark Shell Command Injection - ProcessCreation

Oct 17, 2023 · attack.initial_access attack.t1190 cve.2022.33891 ·

Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

Application Using Device Code Authentication Flow

Oct 17, 2023 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Oct 17, 2023 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Arbitrary Shell Command Execution Via Settingcontent-Ms

Oct 17, 2023 · attack.t1204 attack.t1566.001 attack.execution attack.initial_access ·

Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Atlassian Confluence CVE-2022-26134

Oct 17, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2022.26134 ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Authentications To Important Apps Using Single Factor Authentication

Oct 17, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detect when authentications to important application(s) only required single-factor authentication

Azure AD Only Single Factor Authentication Required

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1556.006 ·

Share on:

Detect when users are authenticating without MFA being required.

Azure Domain Federation Settings Modified

Oct 17, 2023 · attack.initial_access attack.t1078 ·

Share on:

Identifies when an user or application modified the federation settings on the domain.

Azure Subscription Permission Elevation Via ActivityLogs

Oct 17, 2023 · attack.initial_access attack.t1078.004 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Azure Unusual Authentication Interruption

Oct 17, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects when there is a interruption in the authentication process.

Cross Site Scripting Strings

Oct 17, 2023 · attack.initial_access attack.t1189 ·

Share on:

Detects XSS attempts injected via GET requests in access logs

Device Installation Blocked

Oct 17, 2023 · attack.initial_access attack.t1200 ·

Share on:

Detects an installation of a device that is forbidden by the system policy

DNS Query to External Service Interaction Domains

Oct 17, 2023 · attack.initial_access attack.t1190 attack.reconnaissance attack.t1595.002 ·

Share on:

Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE

Failed Authentications From Countries You Do Not Operate Out Of

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·

Share on:

Detect failed authentications from countries you do not operate out of.

Guest Users Invited To Tenant By Non Approved Inviters

Oct 17, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects guest users being invited to tenant by non-approved inviters

ISO File Created Within Temp Folders

Oct 17, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

Multifactor Authentication Interrupted

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Office Macro File Creation

Oct 17, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of a new office macro files on the systems

OMIGOD SCX RunAsProvider ExecuteScript

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Password Protected ZIP File Opened (Email Attachment)

Oct 17, 2023 · attack.defense_evasion attack.initial_access attack.t1027 attack.t1566.001 ·

Share on:

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Phishing Pattern ISO in Archive

Oct 17, 2023 · attack.initial_access attack.t1566 ·

Share on:

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Sign-in Failure Due to Conditional Access Requirements Not Met

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1110 attack.t1078.004 ·

Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Successful Authentications From Countries You Do Not Operate Out Of

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·

Share on:

Detect successful authentications from countries you do not operate out of.

Suspicious File Drop by Exchange

Oct 17, 2023 · attack.persistence attack.t1190 attack.initial_access attack.t1505.003 ·

Share on:

Detects suspicious file type dropped by an Exchange component in IIS

Suspicious Processes Spawned by WinRM

Oct 17, 2023 · attack.t1190 attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Unusual File Modification by dns.exe

Oct 17, 2023 · attack.initial_access attack.t1133 ·

Share on:

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

User State Changed From Guest To Member

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.t1078.004 ·

Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Users Authenticating To Other Azure AD Tenants

Oct 17, 2023 · attack.initial_access attack.t1078.004 ·

Share on:

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

AWS Suspicious SAML Activity

Oct 12, 2023 · attack.initial_access attack.t1078 attack.lateral_movement attack.t1548 attack.privilege_escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Azure Subscription Permission Elevation Via AuditLogs

Oct 12, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Login to Disabled Account

Oct 12, 2023 · attack.initial_access attack.t1078.004 ·

Share on:

Detect failed attempts to sign in to disabled accounts.

Logon from a Risky IP Address

Oct 12, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Microsoft 365 - Impossible Travel Activity

Oct 12, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Microsoft 365 - User Restricted from Sending Email

Oct 12, 2023 · attack.initial_access attack.t1199 ·

Share on:

Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

Multifactor Authentication Denied

Oct 12, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Potential MFA Bypass Using Legacy Client Authentication

Oct 12, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·

Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

User Access Blocked by Azure Conditional Access

Oct 12, 2023 · attack.credential_access attack.initial_access attack.t1110 attack.t1078.004 ·

Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Arcadyan Router Exploitations

Oct 4, 2023 · attack.initial_access attack.t1190 cve.2021.20090 cve.2021.20091 detection.emerging_threats ·

Share on:

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Azure AD Threat Intelligence

Sep 11, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

SQL Injection Strings In URI

Sep 6, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects potential SQL injection attempts via GET requests in access logs.

Activity From Anonymous IP Address

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Atypical Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

New Country

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Suspicious Browser Activity

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Unfamiliar Sign-In Properties

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Path Traversal Exploitation Attempts

Sep 1, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects path traversal exploitation attempts

Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

ADSelfService Exploitation

Aug 28, 2023 · cve.2021.40539 detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

Apache Threading Error

Aug 28, 2023 · attack.initial_access attack.lateral_movement attack.t1190 attack.t1210 ·

Share on:

Detects an issue in apache logs that reports threading related errors

ISO or Image Mount Indicator in Recent Files

Aug 28, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

JNDIExploit Pattern

Aug 28, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects exploitation attempt using the JNDI-Exploit-Kit

Search-ms and WebDAV Suspicious Indicators in URL

Aug 25, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaigns.

User Added To Admin Group Via Sysadminctl

Aug 22, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Root Account Enable Via Dsenableroot

Aug 22, 2023 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial_access attack.persistence ·

Share on:

Detects attempts to enable the root account via "dsenableroot"

Search-ms and WebDAV Indicators in URL

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaign.

WebDAV Temporary Local File Creation

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects the creation of WebDAV temporary files with suspicious extensions

Windows Registry Trust Record Modification

Jul 13, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Alerts on trust record modification within the registry, indicating usage of macros

Spring Framework Exceptions

Jun 26, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects suspicious Spring framework exceptions that could indicate exploitation attempts

External Disk Drive Or USB Storage Device

Jun 21, 2023 · attack.t1091 attack.t1200 attack.lateral_movement attack.initial_access ·

Share on:

Detects external diskdrives or plugged in USB devices, EventID 6416 on Windows 10 or later

Cisco ASA FTD Exploit CVE-2020-3452

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2020.3452 detection.emerging_threats ·

Share on:

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.8193 cve.2020.8195 detection.emerging_threats ·

Share on:

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Citrix Netscaler Attack CVE-2019-19781

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2019.19781 detection.emerging_threats ·

Share on:

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

CVE-2010-5278 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2010.5278 detection.emerging_threats ·

Share on:

MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.

CVE-2020-0688 Exchange Exploitation via Web Log

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.0688 detection.emerging_threats ·

Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

CVE-2020-0688 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.0688 detection.emerging_threats ·

Share on:

Detects CVE-2020-0688 Exploitation attempts

CVE-2020-10148 SolarWinds Orion API Auth Bypass

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.10148 detection.emerging_threats ·

Share on:

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

CVE-2020-5902 F5 BIG-IP Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.5902 detection.emerging_threats ·

Share on:

Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Jun 20, 2023 · attack.initial_access attack.t1190 attack.persistence attack.t1505.003 cve.2021.40539 detection.emerging_threats ·

Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

CVE-2023-23397 Exploitation Attempt

Jun 20, 2023 · attack.credential_access attack.initial_access cve.2023.23397 detection.emerging_threats ·

Share on:

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

DNS RCE CVE-2020-1350

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1569.002 cve.2020.1350 detection.emerging_threats ·

Share on:

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

Droppers Exploiting CVE-2017-11882

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.11882 detection.emerging_threats ·

Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Exploit for CVE-2017-0261

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.0261 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Exploit for CVE-2017-8759

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.8759 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Exploitation of CVE-2021-26814 in Wazuh

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.21978 cve.2021.26814 detection.emerging_threats ·

Share on:

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

Exploited CVE-2020-10189 Zoho ManageEngine

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020.10189 detection.emerging_threats ·

Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Fortinet CVE-2018-13379 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2018.13379 detection.emerging_threats ·

Share on:

Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

Fortinet CVE-2021-22123 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.22123 detection.emerging_threats ·

Share on:

Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

Grafana Path Traversal Exploitation CVE-2021-43798

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.43798 detection.emerging_threats ·

Share on:

Detects a successful Grafana path traversal exploitation

Log4j RCE CVE-2021-44228 Generic

Jun 20, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Oracle WebLogic Exploit

Jun 20, 2023 · attack.t1190 attack.initial_access attack.persistence attack.t1505.003 cve.2018.2894 detection.emerging_threats ·

Share on:

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Oracle WebLogic Exploit CVE-2020-14882

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2020.14882 detection.emerging_threats ·

Share on:

Detects exploitation attempts on WebLogic servers

Oracle WebLogic Exploit CVE-2021-2109

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2021.2109 detection.emerging_threats ·

Share on:

Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109

Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2021.26084 detection.emerging_threats ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Potential CVE-2021-27905 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.27905 detection.emerging_threats ·

Share on:

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Potential CVE-2023-2283 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.2283 detection.emerging_threats ·

Share on:

Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

Potential CVE-2023-23752 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.23752 detection.emerging_threats ·

Share on:

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Potential CVE-2023-25157 Exploitation Attempt

Jun 20, 2023 · attack.initial_access cve.2023.25157 detection.emerging_threats ·

Share on:

Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer

Potential CVE-2023-25717 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.25717 detection.emerging_threats ·

Share on:

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Pulse Connect Secure RCE Attack CVE-2021-22893

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.22893 detection.emerging_threats ·

Share on:

This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

Pulse Secure Attack CVE-2019-11510

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2019.11510 detection.emerging_threats ·

Share on:

Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

Sitecore Pre-Auth RCE CVE-2021-42237

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.42237 detection.emerging_threats ·

Share on:

Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237 found in Report.ashx

SonicWall SSL/VPN Jarrewrite Exploitation

Jun 20, 2023 · attack.t1190 attack.initial_access detection.emerging_threats ·

Share on:

Detects exploitation attempts of the SonicWall Jarrewrite Exploit

Successful Exchange ProxyShell Attack

Jun 20, 2023 · attack.initial_access detection.emerging_threats ·

Share on:

Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

TerraMaster TOS CVE-2020-28188

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2020.28188 detection.emerging_threats ·

Share on:

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

VMware vCenter Server File Upload CVE-2021-22005

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.22005 detection.emerging_threats ·

Share on:

Detects exploitation attempts using file upload vulnerability CVE-2021-22005 in the VMWare vCenter Server.

Download From Suspicious TLD - Blacklist

May 18, 2023 · attack.initial_access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects download of certain file types from hosts in suspicious TLDs

Download From Suspicious TLD - Whitelist

May 18, 2023 · attack.initial_access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects executable downloads from suspicious remote systems

Suspicious Computer Machine Password by PowerShell

May 15, 2023 · attack.initial_access attack.t1078 ·

Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Yellow Cockatoo Powershell Startup Folder Persistence (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects .lnk files created by Powershell in the startup folder. Associated with (but not unique to) Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Yellow Cockatoo PowerShell Suspicious .NET Methods (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects suspicious Powershell script load contents associated with Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Okta FastPass Phishing Detection

May 10, 2023 · attack.initial_access attack.t1566 ·

Share on:

Detects when Okta FastPass prevents a known phishing site.

Suspicious Child Process Of SQL Server

May 9, 2023 · attack.t1505.003 attack.t1190 attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Suspicious Child Process Of Veeam Dabatase

May 9, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Disabled Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple disabled domain accounts from a single source system using the Kerberos protocol.

Invalid Users Failing To Authenticate From Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.

Invalid Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the Kerberos protocol.

Multiple Suspicious Resp Codes Caused by Single Client

Apr 21, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects possible exploitation activity or bugs in a web application

Multiple Users Failing to Authenticate from Single Process

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple accounts from a single process on the system.

Multiple Users Remotely Failing To Authenticate From Single Source

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects a source system failing to authenticate against a remote host with multiple users.

OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Password Spraying via Explicit Credentials

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects a single user failing to authenticate to multiple users using explicit credentials.

Possible DNS Rebinding

Apr 21, 2023 · attack.initial_access attack.t1189 ·

Share on:

Detects several different DNS-answers by one domain with IPs from internal and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved in host cache for a while TTL).

Valid Users Failing to Authenticate From Single Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.

Valid Users Failing to Authenticate from Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.

HTML Help HH.EXE Suspicious Child Process

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Suspicious HH.EXE Execution

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious Browser Child Process - MacOS

Apr 5, 2023 · attack.initial_access attack.execution attack.t1189 attack.t1203 attack.t1059 ·

Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Remote Access Tool - ScreenConnect Suspicious Execution

Mar 5, 2023 · attack.initial_access attack.t1133 ·

Share on:

Detects ScreenConnect program starts that establish a remote access to that system (not meeting, not remote support)

Terminal Service Process Spawn

Mar 5, 2023 · attack.initial_access attack.t1190 attack.lateral_movement attack.t1210 car.2013-07-002 ·

Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Unusual Child Process of dns.exe

Mar 5, 2023 · attack.initial_access attack.t1133 ·

Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Execution in Outlook Temp Folder

Mar 2, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects a suspicious program execution in Outlook temp folder

Suspicious Double Extension File Execution

Feb 28, 2023 · attack.initial_access attack.t1566.001 ·

Share on:

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Guest Account Enabled Via Sysadminctl

Feb 20, 2023 · attack.initial_access attack.t1078 attack.t1078.001 ·

Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Potential XXE Exploitation Attempt In JVM Based Application

Feb 20, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.

Unusual File Deletion by Dns.exe

Feb 17, 2023 · attack.initial_access attack.t1133 ·

Share on:

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Potential JNDI Injection Exploitation In JVM Based Application

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.

Potential Local File Read Vulnerability In JVM Based Application

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.

Potential OGNL Injection Exploitation In JVM Based Application

Feb 15, 2023 · attack.initial_access attack.t1190 cve.2017.5638 cve.2022.26134 ·

Share on:

Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)

Potential RCE Exploitation Attempt In NodeJS

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.

Potential Server Side Template Injection In Velocity

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Potential SpEL Injection In Spring Framework

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects potential SpEL Injection exploitation, which may lead to RCE.

Process Execution Error In JVM Based Application

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects process execution related exceptions in JVM based apps, often relates to RCE

Suspicious SQL Error Messages

Feb 15, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects SQL error messages that indicate probing for an injection attack

Flash Player Update from Suspicious Location

Feb 1, 2023 · attack.initial_access attack.t1189 attack.execution attack.t1204.002 attack.defense_evasion attack.t1036.005 ·

Share on:

Detects a flashplayer update from an unofficial location

Hack Tool User Agent

Feb 1, 2023 · attack.initial_access attack.t1190 attack.credential_access attack.t1110 ·

Share on:

Detects suspicious user agent strings user by hack tools in proxy logs

Suspicious HWP Sub Processes

Feb 1, 2023 · attack.initial_access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·

Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Suspicious MSExchangeMailboxReplication ASPX Write

Feb 1, 2023 · attack.initial_access attack.t1190 attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Suspicious Named Error

Feb 1, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Suspicious OpenSSH Daemon Error

Feb 1, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Suspicious VSFTPD Error Messages

Feb 1, 2023 · attack.initial_access attack.t1190 ·

Share on:

Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

USB Device Plugged

Feb 1, 2023 · attack.initial_access attack.t1200 ·

Share on:

Detects plugged/unplugged USB devices

Java Class Proxy Download

Jan 31, 2023 · attack.initial_access ·

Share on:

Detects Java class download in proxy logs, e.g. used in Log4shell exploitation attacks against Log4j.

Ursnif Malware C2 URL Pattern

Jan 31, 2023 · attack.initial_access attack.t1566.001 attack.execution attack.t1204.002 attack.command_and_control attack.t1071.001 ·

Share on:

Detects Ursnif C2 traffic.

External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Suspicious Commands by SQL Server

Jan 8, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious commands created from sqlservr process.

ISO Image Mount

Dec 28, 2022 · attack.initial_access attack.t1566.001 ·

Share on:

Detects the mount of ISO images on an endpoint

Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.