attack.lateral-movement

Suspicious Non PowerShell WSMAN COM Provider

Oct 8, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Oct 1, 2024 · cve.2023-46214 detection.emerging-threats attack.lateral-movement attack.t1210 ·

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

Potential CVE-2023-46214 Exploitation Attempt

Oct 1, 2024 · attack.lateral-movement attack.t1210 cve.2023-46214 detection.emerging-threats ·

Share on:

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Oct 1, 2024 · attack.t1021.003 attack.lateral-movement ·

Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Potential RDP Exploit CVE-2019-0708

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Persistence and Execution at Scale via GPO Scheduled Task

Sep 6, 2024 · attack.persistence attack.lateral-movement attack.t1053.005 ·

Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC

Sep 2, 2024 · attack.execution attack.lateral-movement attack.t1210 cve.2020-1472 detection.emerging-threats ·

Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

HackTool - SharpWSUS/WSUSpendu Execution

Aug 29, 2024 · attack.execution attack.lateral-movement attack.t1210 ·

Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Access To ADMIN$ Network Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects access to ADMIN$ network share

Admin User Remote Logon

Aug 12, 2024 · attack.lateral-movement attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·

Share on:

Detect remote login by Administrator user (depending on internal pattern).

Apache Threading Error

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.t1190 attack.t1210 ·

Share on:

Detects an issue in apache logs that reports threading related errors

APT31 Judgement Panda Activity

Aug 12, 2024 · attack.lateral-movement attack.credential-access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging-threats ·

Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

AWS Console GetSigninToken Potential Abuse

Aug 12, 2024 · attack.lateral-movement attack.t1021.007 attack.t1550.001 ·

Share on:

Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

AWS STS AssumeRole Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

AWS STS GetSessionToken Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Bitbucket Global SSH Settings Changed

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·

Share on:

Detects Bitbucket global SSH access configuration changes.

Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

CobaltStrike Service Installations - Security

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

CobaltStrike Service Installations - System

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Copy From Or To Admin Share Or Sysvol Folder

Aug 12, 2024 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

DCERPC SMB Spoolss Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Denied Access To Remote Desktop

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·

Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Enable Windows Remote Management

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Execute Invoke-command on Remote Host

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

External Disk Drive Or USB Storage Device Was Recognized By The System

Aug 12, 2024 · attack.t1091 attack.t1200 attack.lateral-movement attack.initial-access ·

Share on:

Detects external disk drives or plugged-in USB devices.

First Time Seen Remote Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

First Time Seen Remote Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

HackTool - Evil-WinRm Execution - PowerShell Module

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

HackTool - KrbRelayUp Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

HackTool - Rubeus Execution

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

HackTool - Rubeus Execution - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

HackTool - SharpMove Tool Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

HackTool - WinRM Access Via Evil-WinRM

Aug 12, 2024 · attack.lateral-movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

HackTool - Wmiexec Default Powershell Command

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement ·

Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Hermetic Wiper TG Process Patterns

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1021.001 detection.emerging-threats ·

Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Impacket PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects execution of Impacket's psexec.py.

Metasploit Or Impacket Service Installation Via SMB PsExec

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Metasploit SMB Authentication

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Alerts on Metasploit host's authentications on the domain.

Mimikatz Use

Aug 12, 2024 · attack.s0002 attack.lateral-movement attack.credential-access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·

Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

MMC Spawning Windows Shell

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 ·

Share on:

Detects a Windows command line executable started from MMC

Mstsc.EXE Execution From Uncommon Parent

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

New Remote Desktop Connection Initiated Via Mstsc.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·

Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

NTLM Logon

Aug 12, 2024 · attack.lateral-movement attack.t1550.002 ·

Share on:

Detects logons using NTLM, which could be caused by a legacy source or attackers

NTLMv1 Logon Between Client and Server

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1550.002 ·

Share on:

Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.

OMIGOD HTTP No Authentication RCE

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·

Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

OpenCanary - SMB File Open Request

Aug 12, 2024 · attack.lateral-movement attack.collection attack.t1021 attack.t1005 ·

Share on:

Detects instances where an SMB service on an OpenCanary node has had a file open request.

OpenCanary - SNMP OID Request

Aug 12, 2024 · attack.discovery attack.lateral-movement attack.t1016 attack.t1021 ·

Share on:

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

OpenCanary - SSH Login Attempt

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

OpenCanary - SSH New Connection Attempt

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

OpenCanary - VNC Connection Attempt

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·

Share on:

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

OpenSSH Server Listening On Socket

Aug 12, 2024 · attack.lateral-movement attack.t1021.004 ·

Share on:

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Outbound RDP Connections Over Non-Standard Tools

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

Outgoing Logon with New Credentials

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1550 ·

Share on:

Detects logon events that specify new credentials

Pass the Hash Activity 2

Aug 12, 2024 · attack.lateral-movement attack.t1550.002 ·

Share on:

Detects the attack technique pass the hash which is used to move laterally inside the network

Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

PDQ Deploy Remote Adminstartion Tool Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·

Share on:

Detect use of PDQ Deploy remote admin tool

Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

Possible Exploitation of Exchange RCE CVE-2021-42321

Aug 12, 2024 · attack.lateral-movement attack.t1210 detection.emerging-threats ·

Share on:

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Potential CobaltStrike Service Installations - Registry

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Potential DCOM InternetExplorer.Application DLL Hijack

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Potential MSTSC Shadowing Activity

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 ·

Share on:

Detects RDP session hijacking by using MSTSC shadowing

Potential Persistence Via Logon Scripts - Registry

Aug 12, 2024 · attack.t1037.001 attack.persistence attack.lateral-movement ·

Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Potential Remote Desktop Tunneling

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·

Share on:

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Potential Remote PowerShell Session Initiated

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·

Share on:

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Privilege Escalation via Named Pipe Impersonation

Aug 12, 2024 · attack.lateral-movement attack.t1021 ·

Share on:

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Protected Storage Service Access

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

PSExec and WMI Process Creations Block

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1047 attack.t1569.002 ·

Share on:

Detects blocking of process creations originating from PSExec and WMI commands

PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·

Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

PUA - CSExec Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default CSExec pipe creation

PUA - Radmin Viewer Utility Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·

Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

PUA - RemCom Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default RemCom pipe creation

Publicly Accessible RDP Service

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·

Share on:

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

RDP Login from Localhost

Aug 12, 2024 · attack.lateral-movement car.2013-07-002 attack.t1021.001 ·

Share on:

RDP login with localhost source address may be a tunnelled login

RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Register new Logon Process by Rubeus

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1558.003 ·

Share on:

Detects potential use of Rubeus via registered new trusted logon process

Remote DCOM/WMI Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 attack.t1047 ·

Share on:

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Remote Encrypting File System Abuse

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Remote File Copy

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1105 ·

Share on:

Detects the use of tools that copy files from or to remote systems

Remote LSASS Process Access Through Windows Remote Management

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral-movement attack.t1021.006 attack.s0002 ·

Share on:

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

Remote PowerShell Session (PS Classic)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Remote PowerShell Session (PS Module)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Remote Printing Abuse for Lateral Movement

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Remote Registry Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1112 ·

Share on:

Detects remote RPC calls to modify the registry and possible execute code

Remote Schedule Task Lateral Movement via ATSvc

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task

Remote Schedule Task Lateral Movement via SASec

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Remote Server Service Abuse

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

Remote Server Service Abuse for Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1569.002 ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Remote Service Activity via SVCCTL Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence attack.t1021.002 ·

Share on:

Detects remote service activity via remote access to the svcctl named pipe

Remote Task Creation via ATSVC Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Remote Task Creation via ATSVC Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Rundll32 Execution Without Parameters

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

SMB Create Remote File Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

SMB Spoolss Name Piped Usage

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

smbexec.py Service Installation

Aug 12, 2024 · attack.lateral-movement attack.execution attack.t1021.002 attack.t1569.002 ·

Share on:

Detects the use of smbexec.py tool by detecting a specific service installation

Successful Overpass the Hash Attempt

Aug 12, 2024 · attack.lateral-movement attack.s0002 attack.t1550.002 ·

Share on:

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.

Suspicious New-PSDrive to Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·

Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Suspicious PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Suspicious PsExec Execution - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Suspicious RDP Redirect Using TSCON

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects a suspicious RDP session redirect using tscon.exe

Suspicious Remote Logon with Explicit Credentials

Aug 12, 2024 · attack.t1078 attack.lateral-movement ·

Share on:

Detects suspicious processes logging on with explicit credentials

Suspicious SysAidServer Child

Aug 12, 2024 · attack.lateral-movement attack.t1210 ·

Share on:

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Suspicious UltraVNC Execution

Aug 12, 2024 · attack.lateral-movement attack.g0047 attack.t1021.005 ·

Share on:

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Suspicious WSMAN Provider Image Loads

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

T1047 Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

Terminal Service Process Spawn

Aug 12, 2024 · attack.initial-access attack.t1190 attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Turla Group Lateral Movement

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059 attack.lateral-movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging-threats ·

Share on:

Detects automated lateral movement by Turla group

Uncommon Outbound Kerberos Connection

Aug 12, 2024 · attack.credential-access attack.t1558 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Uncommon Outbound Kerberos Connection - Security

Aug 12, 2024 · attack.lateral-movement attack.t1558.003 ·

Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

User Added to Remote Desktop Users Group

Aug 12, 2024 · attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·

Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1558.003 ·

Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

WannaCry Ransomware Activity

Aug 12, 2024 · attack.lateral-movement attack.t1210 attack.discovery attack.t1083 attack.defense-evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging-threats ·

Share on:

Detects WannaCry ransomware activity

Windows Admin Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when an admin share is mounted using net.exe

Windows Internet Hosted WebDav Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Windows Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when a share is mounted using the "net.exe" utility

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·

Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Wmiexec Default Output File

Aug 12, 2024 · attack.lateral-movement attack.t1047 ·

Share on:

Detects the creation of the default output filename used by the wmiexec tool

Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Wmiprvse Wbemcomn DLL Hijack - File

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Writing Local Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1546.002 ·

Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

Zerologon Exploitation Using Well-known Tools

Aug 12, 2024 · attack.t1210 attack.lateral-movement ·

Share on:

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.