attack.lateral_movement

HackTool - KrbRelayUp Execution

Dec 1, 2023 · attack.credential_access attack.t1558.003 attack.lateral_movement attack.t1550.003 ·

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

New Remote Desktop Connection Initiated Via Mstsc.EXE

Dec 1, 2023 · attack.lateral_movement attack.t1021.001 ·

Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

PDQ Deploy Remote Adminstartion Tool Execution

Dec 1, 2023 · attack.execution attack.lateral_movement attack.t1072 ·

Share on:

Detect use of PDQ Deploy remote admin tool

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Nov 27, 2023 · cve.2023.46214 detection.emerging_threats attack.lateral_movement attack.t1210 ·

Share on:

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

Potential CVE-2023-46214 Exploitation Attempt

Nov 27, 2023 · attack.lateral_movement attack.t1210 cve.2023.46214 detection.emerging_threats ·

Share on:

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Nov 14, 2023 · attack.t1021.003 attack.lateral_movement ·

Share on:

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

smbexec.py Service Installation

Nov 10, 2023 · attack.lateral_movement attack.execution attack.t1021.002 attack.t1569.002 ·

Share on:

Detects the use of smbexec.py tool by detecting a specific service installation

Port Forwarding Activity Via SSH.EXE

Nov 6, 2023 · attack.command_and_control attack.lateral_movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

Privilege Escalation via Named Pipe Impersonation

Nov 2, 2023 · attack.lateral_movement attack.t1021 ·

Share on:

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

NTLMv1 Logon Between Client and Server

Oct 28, 2023 · attack.defense_evasion attack.lateral_movement attack.t1550.002 ·

Share on:

Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Oct 28, 2023 · attack.lateral_movement attack.privilege_escalation attack.persistence attack.t1546.003 ·

Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Remote PowerShell Session (PS Classic)

Oct 28, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Suspicious Non PowerShell WSMAN COM Provider

Oct 28, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.003 ·

Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Possible Exploitation of Exchange RCE CVE-2021-42321

Oct 26, 2023 · attack.lateral_movement attack.t1210 detection.emerging_threats ·

Share on:

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Copy from Admin Share

Oct 18, 2023 · attack.lateral_movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a suspicious copy command to or from an Admin share or remote

HackTool - Rubeus Execution

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Hermetic Wiper TG Process Patterns

Oct 18, 2023 · attack.execution attack.lateral_movement attack.t1021.001 detection.emerging_threats ·

Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Microsoft Binary Suspicious Communication Endpoint

Oct 18, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects an executable in the Windows folder accessing suspicious domains

MMC Spawning Windows Shell

Oct 18, 2023 · attack.lateral_movement attack.t1021.003 ·

Share on:

Detects a Windows command line executable started from MMC

Net.exe Execution

Oct 18, 2023 · attack.discovery attack.t1007 attack.t1049 attack.t1018 attack.t1135 attack.t1201 attack.t1069.001 attack.t1069.002 attack.t1087.001 attack.t1087.002 attack.lateral_movement attack.t1021.002 attack.s0039 ·

Share on:

Detects execution of Net.exe, whether suspicious or benign.

New Port Forwarding Rule Added Via Netsh.EXE

Oct 18, 2023 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

OMIGOD HTTP No Authentication RCE

Oct 18, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.lateral_movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·

Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Outbound RDP Connections Over Non-Standard Tools

Oct 18, 2023 · attack.lateral_movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement

Password Provided In Command Line Of Net.EXE

Oct 18, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

Publicly Accessible RDP Service

Oct 18, 2023 · attack.lateral_movement attack.t1021.001 ·

Share on:

Detects connections from routable IPs to an RDP listener - which is indicative of a publicly-accessible RDP service.

Remote PowerShell Session (Network)

Oct 18, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·

Share on:

Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account.

Remote Task Creation via ATSVC Named Pipe - Zeek

Oct 18, 2023 · attack.lateral_movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Suspicious Add User to Remote Desktop Users Group

Oct 18, 2023 · attack.persistence attack.lateral_movement attack.t1133 attack.t1136.001 attack.t1021.001 ·

Share on:

Detects suspicious command line in which a user gets added to the local Remote Desktop Users group

Suspicious Epmap Connection

Oct 18, 2023 · attack.lateral_movement ·

Share on:

Detects suspicious "epmap" connection to a remote computer via remote procedure call (RPC)

Suspicious Outbound Kerberos Connection

Oct 18, 2023 · attack.credential_access attack.t1558 attack.lateral_movement attack.t1550.003 ·

Share on:

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Suspicious Outbound Kerberos Connection - Security

Oct 18, 2023 · attack.lateral_movement attack.t1558.003 ·

Share on:

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Suspicious WSMAN Provider Image Loads

Oct 18, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.003 ·

Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Turla Group Lateral Movement

Oct 18, 2023 · attack.g0010 attack.execution attack.t1059 attack.lateral_movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging_threats ·

Share on:

Detects automated lateral movement by Turla group

User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Oct 18, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1558.003 ·

Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

WannaCry Ransomware Activity

Oct 18, 2023 · attack.lateral_movement attack.t1210 attack.discovery attack.t1083 attack.defense_evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging_threats ·

Share on:

Detects WannaCry ransomware activity

Windows Admin Share Mount Via Net.EXE

Oct 18, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects when an admin share is mounted using net.exe

Windows Internet Hosted WebDav Share Mount Via Net.EXE

Oct 18, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Windows Share Mount Via Net.EXE

Oct 18, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects when a share is mounted using the "net.exe" utility

Audit CVE Event

Oct 17, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Metasploit Or Impacket Service Installation Via SMB PsExec

Oct 17, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

NTLM Logon

Oct 17, 2023 · attack.lateral_movement attack.t1550.002 ·

Share on:

Detects logons using NTLM, which could be caused by a legacy source or attackers

OpenSSH Server Listening On Socket

Oct 17, 2023 · attack.lateral_movement attack.t1021.004 ·

Share on:

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Outgoing Logon with New Credentials

Oct 17, 2023 · attack.defense_evasion attack.lateral_movement attack.t1550 ·

Share on:

Detects logon events that specify new credentials

Potential Remote Desktop Tunneling

Oct 17, 2023 · attack.lateral_movement attack.t1021 ·

Share on:

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

RDP over Reverse SSH Tunnel WFP

Oct 17, 2023 · attack.defense_evasion attack.command_and_control attack.lateral_movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

RDP to HTTP or HTTPS Target Ports

Oct 17, 2023 · attack.command_and_control attack.t1572 attack.lateral_movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Suspicious New-PSDrive to Admin Share

Oct 17, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Suspicious Remote Logon with Explicit Credentials

Oct 17, 2023 · attack.t1078 attack.lateral_movement ·

Share on:

Detects suspicious processes logging on with explicit credentials

Suspicious SysAidServer Child

Oct 17, 2023 · attack.lateral_movement attack.t1210 ·

Share on:

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

User with Privileges Logon

Oct 17, 2023 · attack.defense_evasion attack.lateral_movement attack.credential_access attack.t1558 attack.t1649 attack.t1550 ·

Share on:

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

Writing Local Admin Share

Oct 17, 2023 · attack.lateral_movement attack.t1546.002 ·

Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

AWS STS AssumeRole Misuse

Oct 12, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

AWS STS GetSessionToken Misuse

Oct 12, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

AWS Suspicious SAML Activity

Oct 12, 2023 · attack.initial_access attack.t1078 attack.lateral_movement attack.t1548 attack.privilege_escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Possible Impacket DCOMExec Connection Attempt - Zeek

Sep 1, 2023 · attack.s0357 attack.execution attack.lateral_movement attack.t1021 attack.t1021.003 ·

Share on:

Detects attempts to connect via DCOM Endpoints, as used by Impacket DCOMExec. This event will occur on successful or unsuccessful attempts using any of the three DCOMExec -object options.

Apache Threading Error

Aug 28, 2023 · attack.initial_access attack.lateral_movement attack.t1190 attack.t1210 ·

Share on:

Detects an issue in apache logs that reports threading related errors

CobaltStrike Service Installations in Registry

Aug 17, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_cobaltstrike_service_installs.yml) In some SIEM you can catch those events also in HKLM\System\ControlSet001\Services or HKLM\System\ControlSet002\Services, however, this rule is based on a regular sysmon's events.

CSExec Default Named Pipe

Aug 7, 2023 · attack.lateral_movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default CSExec pipe creation

RemCom Default Named Pipe

Aug 7, 2023 · attack.lateral_movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default RemCom pipe creation

HackTool - Rubeus Execution - ScriptBlock

Jun 26, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

SMB Create Remote File Admin Share

Jun 26, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Successful Overpass the Hash Attempt

Jun 26, 2023 · attack.lateral_movement attack.s0002 attack.t1550.002 ·

Share on:

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.

Remote DCOM/WMI Lateral Movement

Jun 22, 2023 · attack.lateral_movement attack.t1021.003 attack.t1047 ·

Share on:

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Remote Encrypting File System Abuse

Jun 22, 2023 · attack.lateral_movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Remote Printing Abuse for Lateral Movement

Jun 22, 2023 · attack.lateral_movement ·

Share on:

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Remote Registry Lateral Movement

Jun 22, 2023 · attack.lateral_movement attack.t1112 ·

Share on:

Detects remote RPC calls to modify the registry and possible execute code

Remote Schedule Task Lateral Movement via ATSvc

Jun 22, 2023 · attack.lateral_movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Jun 22, 2023 · attack.lateral_movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task

Remote Schedule Task Lateral Movement via SASec

Jun 22, 2023 · attack.lateral_movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Remote Server Service Abuse

Jun 22, 2023 · attack.lateral_movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

Remote Server Service Abuse for Lateral Movement

Jun 22, 2023 · attack.lateral_movement attack.t1569.002 ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

External Disk Drive Or USB Storage Device

Jun 21, 2023 · attack.t1091 attack.t1200 attack.lateral_movement attack.initial_access ·

Share on:

Detects external diskdrives or plugged in USB devices, EventID 6416 on Windows 10 or later

APT31 Judgement Panda Activity

Jun 20, 2023 · attack.lateral_movement attack.credential_access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging_threats ·

Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Potential Persistence Via Logon Scripts - Registry

Jun 9, 2023 · attack.t1037.001 attack.persistence attack.lateral_movement ·

Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Jun 1, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Suspicious RDP Redirect Using TSCON

May 17, 2023 · attack.lateral_movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects a suspicious RDP session redirect using tscon.exe

PSEXEC Remote Execution File Artefact

May 15, 2023 · attack.lateral_movement attack.privilege_escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·

Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Remote PowerShell Session (PS Module)

May 15, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Default Impacket Service Creation Via Registry Keys (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects registry key creation matching default Impacket default naming convention. Part of the RedCanary 2023 Threat Detection Report.

File Writes Within Admin Shares (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects files written to an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Process Execution from Admin Share (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects processes executing from an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Admin User Remote Logon

May 2, 2023 · attack.lateral_movement attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·

Share on:

Detect remote login by Administrator user (depending on internal pattern).

Pass the Hash Activity 2

May 2, 2023 · attack.lateral_movement attack.t1550.002 ·

Share on:

Detects the attack technique pass the hash which is used to move laterally inside the network

RDP Login from Localhost

May 2, 2023 · attack.lateral_movement car.2013-07-002 attack.t1021.001 ·

Share on:

RDP login with localhost source address may be a tunnelled login

Remote WMI ActiveScriptEventConsumers

May 2, 2023 · attack.lateral_movement attack.privilege_escalation attack.persistence attack.t1546.003 ·

Share on:

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network

Scanner PoC for CVE-2019-0708 RDP RCE Vuln

May 2, 2023 · attack.lateral_movement attack.t1210 car.2013-07-002 ·

Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Failed Mounting of Hidden Share

Apr 21, 2023 · attack.t1021.002 attack.lateral_movement ·

Share on:

Detects repeated failed (outgoing) attempts to mount a hidden share

Metasploit Or Impacket Service Installation Via SMB PsExec

Apr 21, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Remote Service Creation

Apr 21, 2023 · attack.lateral_movement attack.persistence attack.execution attack.t1543.003 ·

Share on:

Detects remote execution via service creation on the destination host

Mstsc.EXE Execution From Uncommon Parent

Apr 18, 2023 · attack.lateral_movement ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Suspicious Exe File Event With System Image

Apr 16, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects potential SMB file creation activity associated with Impacket smbclient.py.

CobaltStrike Service Installations - System

Apr 14, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Potential RDP Exploit CVE-2019-0708

Apr 14, 2023 · attack.lateral_movement attack.t1210 car.2013-07-002 ·

Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Zerologon Exploitation Using Well-known Tools

Apr 14, 2023 · attack.t1210 attack.lateral_movement ·

Share on:

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

Rundll32 Execution Without Parameters

Mar 16, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

First Time Seen Remote Named Pipe

Mar 14, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

HackTool - Wmiexec Default Powershell Command

Mar 13, 2023 · attack.defense_evasion attack.lateral_movement ·

Share on:

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Suspicious UltraVNC Execution

Mar 9, 2023 · attack.lateral_movement attack.g0047 attack.t1021.005 ·

Share on:

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Wmiexec Default Output File

Mar 9, 2023 · attack.lateral_movement attack.t1047 ·

Share on:

Detects the creation of the default output filename used by the wmiexec tool

Terminal Service Process Spawn

Mar 5, 2023 · attack.initial_access attack.t1190 attack.lateral_movement attack.t1210 car.2013-07-002 ·

Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

T1047 Wmiprvse Wbemcomn DLL Hijack

Feb 27, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

HackTool - Potential Impacket Lateral Movement Activity

Feb 21, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.003 ·

Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

RDP Port Forwarding Rule Added Via Netsh.EXE

Feb 16, 2023 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

HackTool - WinRM Access Via Evil-WinRM

Feb 13, 2023 · attack.lateral_movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

PUA - Radmin Viewer Utility Execution

Feb 13, 2023 · attack.execution attack.lateral_movement attack.t1072 ·

Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Feb 7, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Protected Storage Service Access

Feb 7, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Wmiprvse Wbemcomn DLL Hijack

Feb 7, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Wmiprvse Wbemcomn DLL Hijack - File

Feb 7, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Feb 6, 2023 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Potential MSTSC Shadowing Activity

Feb 5, 2023 · attack.lateral_movement attack.t1563.002 ·

Share on:

Detects RDP session hijacking by using MSTSC shadowing

Suspicious Plink Port Forwarding

Feb 5, 2023 · attack.command_and_control attack.t1572 attack.lateral_movement attack.t1021.001 ·

Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Access to ADMIN$ Share

Feb 1, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects access to $ADMIN share

CobaltStrike Service Installations - Security

Feb 1, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Mimikatz Use

Feb 1, 2023 · attack.s0002 attack.lateral_movement attack.credential_access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·

Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Pandemic Registry Key

Feb 1, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects Pandemic Windows Implant

Enable Windows Remote Management

Jan 27, 2023 · attack.lateral_movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Execute Invoke-command on Remote Host

Jan 27, 2023 · attack.lateral_movement attack.t1021.006 ·

Share on:

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Enabling RDP service via reg.exe command execution

Jan 8, 2023 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Execution of ZeroLogon PoC executable

Jan 8, 2023 · attack.execution attack.lateral_movement attack.T1210 ·

Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Potential Qbot SMB DLL Lateral Movement

Jan 8, 2023 · attack.lateral_movement attack.t1570 ·

Share on:

Detection of potential us of SMB to transfer DLL's into the C$ folder of hosts unique to Qbot malware for purposes of lateral movement.

Potential SMB DLL Lateral Movement

Jan 8, 2023 · attack.lateral_movement attack.t1570 ·

Share on:

Detection of potential us of SMB to transfer DLL's into the ProgramData folder of hosts for purposes of lateral movement.

AnyDesk Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·

Share on:

Detects use of AnyDesk

SplashTop Network

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·

Share on:

Detects use of SplashTop

SplashTop Process

Jan 8, 2023 · attack.lateral_movement attack.t1133 attack.command_and_control attack.t1219 ·

Share on:

Detects use of SplashTop

Cisco Stage Data

Jan 4, 2023 · attack.collection attack.lateral_movement attack.command_and_control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

First Time Seen Remote Named Pipe - Zeek

Dec 27, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Suspicious PsExec Execution - Zeek

Dec 27, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

PSExec and WMI Process Creations Block

Dec 27, 2022 · attack.execution attack.lateral_movement attack.t1047 attack.t1569.002 ·

Share on:

Detects blocking of process creations originating from PSExec and WMI commands

Potential DCOM InternetExplorer.Application DLL Hijack

Dec 18, 2022 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

RDP Over Reverse SSH Tunnel

Dec 8, 2022 · attack.command_and_control attack.t1572 attack.lateral_movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Executable Deployment from Remote Share

Nov 29, 2022 · attack.lateral_movement attack.command_and_control attack.t1105 attack.t1021 ·

Share on:

Detects use of the copy utility to deploy executable files from a remote share to a temp directory, such as the procedure performed by Vice Ransomware gang.

Mimikatz through Windows Remote Management

Oct 26, 2022 · attack.credential_access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral_movement attack.t1021.006 attack.s0002 ·

Share on:

Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.

DCERPC SMB Spoolss Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Denied Access To Remote Desktop

Oct 25, 2022 · attack.lateral_movement attack.t1021.001 ·

Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Impacket PsExec Execution

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects execution of Impacket's psexec.py.

Persistence and Execution at Scale via GPO Scheduled Task

Oct 25, 2022 · attack.persistence attack.lateral_movement attack.t1053.005 ·

Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Remote Service Activity via SVCCTL Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.persistence attack.t1021.002 ·

Share on:

Detects remote service activity via remote access to the svcctl named pipe

Remote Task Creation via ATSVC Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Suspicious PsExec Execution

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Remote File Copy

Oct 25, 2022 · attack.command_and_control attack.lateral_movement attack.t1105 ·

Share on:

Detects the use of tools that copy files from or to remote systems

Metasploit SMB Authentication

Oct 14, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Alerts on Metasploit host's authentications on the domain.

Register new Logon Process by Rubeus

Oct 14, 2022 · attack.lateral_movement attack.privilege_escalation attack.t1558.003 ·

Share on:

Detects potential use of Rubeus via registered new trusted logon process

PortProxy Registry Key

Oct 9, 2022 · attack.lateral_movement attack.defense_evasion attack.command_and_control attack.t1090 ·

Share on:

Detects the modification of PortProxy registry key which is used for port forwarding. For command execution see rule win_netsh_port_fwd.yml.

SMB Spoolss Name Piped Usage

Oct 9, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Abuse of the Windows Server Update Services (WSUS) for lateral movement.

Oct 7, 2022 · attack.execution attack.lateral_movement attack.T1210 ·

Share on:

Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. Some tools, such as SharpWSUS and WSUSpendu, support lateral movement through WSUS.This rule covers those two main tools used for that purpose.