attack.persistence | Detection.FYI

Writing Of Malicious Files To The Fonts Folder

Dec 4, 2023 · attack.t1211 attack.t1059 attack.defense_evasion attack.persistence ·
Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Read More
Atbroker Registry Change

Dec 1, 2023 · attack.defense_evasion attack.t1218 attack.persistence attack.t1547 ·
Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Read More
Cisco BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco LDP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
Github High Risk Configuration Disabled

Dec 1, 2023 · attack.credential_access attack.defense_evasion attack.persistence attack.t1556 ·
Share on:

Detects when a user disables a critical security feature for an organization.

Read More
Github New Secret Created

Dec 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1078.004 ·
Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Read More
Github Outside Collaborator Detected

Dec 1, 2023 · attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·
Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Read More
Github Self Hosted Runner Changes Detected

Dec 1, 2023 · attack.impact attack.discovery attack.collection attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1526 attack.t1213.003 attack.t1078.004 ·
Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Read More
HackTool - SharPersist Execution

Dec 1, 2023 · attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
Huawei BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
Juniper BGP Missing MD5

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
New Github Organization Member Added

Dec 1, 2023 · attack.persistence attack.t1136.003 ·
Share on:

Detects when a new member is added or invited to a github organization.

Read More
Okta Admin Role Assignment Created

Dec 1, 2023 · attack.persistence ·
Share on:

Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

Read More
Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Dec 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Dec 1, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Suspicious BPF Activity - Linux

Dec 1, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.

Read More
Suspicious Microsoft Office Child Process - MacOS

Dec 1, 2023 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
Suspicious Shells Spawn by Java Utility Keytool

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Suspicious Startup Folder Persistence

Dec 1, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects when a file with a suspicious extension is created in the startup folder

Read More
Uncommon One Time Only Scheduled Task At 00:00

Dec 1, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage

Dec 1, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript

Dec 1, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
VsCode Powershell Profile Modification

Dec 1, 2023 · attack.persistence attack.privilege_escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
New Netsh Helper DLL Registered From A Suspicious Location

Nov 28, 2023 · attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Potential Persistence Via Netsh Helper DLL

Nov 28, 2023 · attack.privilege_escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Potential Persistence Via Netsh Helper DLL - Registry

Nov 28, 2023 · attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Chromium Browser Instance Executed With Custom Extension

Nov 28, 2023 · attack.persistence attack.t1176 ·
Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Read More
Suspicious Chromium Browser Instance Executed With Custom Extension

Nov 28, 2023 · attack.persistence attack.t1176 ·
Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Read More
HAFNIUM Exchange Exploitation Activity

Nov 28, 2023 · attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging_threats ·
Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Read More
Scheduled Task Creation

Nov 27, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks in user session

Read More
Service Registry Permissions Weakness Check

Nov 27, 2023 · attack.persistence attack.t1574.011 stp.2a ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Enabling COR Profiler Environment Variables

Nov 27, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.012 ·
Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Read More
Suspicious Shim Database Installation via Sdbinst.EXE

Nov 15, 2023 · attack.persistence attack.privilege_escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Uncommon Userinit Child Process

Nov 15, 2023 · attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Suspicious Process By Web Server Process

Nov 11, 2023 · attack.persistence attack.t1505.003 attack.t1190 ·
Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More
Chopper Webshell Process Pattern

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More
Shell Process Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
Suspicious Processes Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
Webshell Detection With Command Line Keywords

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More
Webshell Hacking Activity Patterns

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More
Webshell Tool Reconnaissance Activity

Nov 10, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

Read More
Office Application Startup - Office Test

Nov 8, 2023 · attack.persistence attack.t1137.002 ·
Share on:

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Read More
Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 6, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Read More
Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 6, 2023 · attack.persistence attack.defense_evasion ·
Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Read More
Linux Webshell Indicators

Nov 2, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious sub processes of web server processes

Read More
Persistence Via Sudoers Files

Nov 2, 2023 · attack.persistence attack.t1053.003 ·
Share on:

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Read More
Potential Persistence Via Notepad++ Plugins

Nov 2, 2023 · attack.persistence ·
Share on:

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Read More
Potential Persistence Via Security Descriptors - ScriptBlock

Nov 2, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation ·
Share on:

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Read More
Potential RipZip Attack on Startup Folder

Nov 2, 2023 · attack.persistence attack.t1547 ·
Share on:

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Read More
Potential Suspicious Activity Using SeCEdit

Nov 2, 2023 · attack.discovery attack.persistence attack.defense_evasion attack.credential_access attack.privilege_escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Suspicious Execution via macOS Script Editor

Nov 2, 2023 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Suspicious Windows Strings In URI

Nov 2, 2023 · attack.persistence attack.exfiltration attack.t1505.003 ·
Share on:

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Read More
Triple Cross eBPF Rootkit Default Persistence

Nov 2, 2023 · attack.persistence attack.defense_evasion attack.t1053.003 ·
Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read More
Win Susp Computer Name Containing Samtheadmin

Nov 2, 2023 · cve.2021.42278 cve.2021.42287 attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
App Role Added

Oct 28, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 ·
Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Read More
Impossible Travel

Oct 28, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Read More
Potential Amazon SSM Agent Hijacking

Oct 28, 2023 · attack.command_and_control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Binary Or Script Dropper Via PowerShell

Oct 28, 2023 · attack.persistence ·
Share on:

Detects PowerShell creating a binary executable or a script file.

Read More
Potential Linux Amazon SSM Agent Hijacking

Oct 28, 2023 · attack.command_and_control attack.persistence attack.t1219 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Persistence Via App Paths Default Property

Oct 28, 2023 · attack.persistence attack.t1546.012 ·
Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

Read More
Potential Persistence Via COM Hijacking From Suspicious Locations

Oct 28, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a suspicious or unsuale location

Read More
PowerShell Script Dropped Via PowerShell.EXE

Oct 28, 2023 · attack.persistence ·
Share on:

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

Read More
RDP Sensitive Settings Changed

Oct 28, 2023 · attack.defense_evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc

Read More
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Oct 28, 2023 · attack.lateral_movement attack.privilege_escalation attack.persistence attack.t1546.003 ·
Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read More
PowerShell Profile Modification

Oct 28, 2023 · attack.persistence attack.privilege_escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
Diamond Sleet APT Scheduled Task Creation

Oct 28, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 detection.emerging_threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Potential System DLL Sideloading From Non System Locations

Oct 28, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.)

Read More
DarkGate - User Created Via Net.EXE

Oct 26, 2023 · attack.persistence attack.t1136.001 detection.emerging_threats ·
Share on:

Detects creation of local users via the net.exe command with the name of "DarkGate"

Read More
MSSQL Extended Stored Procedure Backdoor Maggie

Oct 26, 2023 · attack.persistence attack.t1546 detection.emerging_threats ·
Share on:

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Read More
Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Oct 26, 2023 · attack.persistence attack.t1505.001 cve.2023.27363 detection.emerging_threats ·
Share on:

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Read More
Potential CVE-2023-36884 Exploitation Dropped File

Oct 26, 2023 · attack.persistence attack.defense_evasion cve.2023.36884 detection.emerging_threats ·
Share on:

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

Read More
StoneDrill Service Install

Oct 26, 2023 · attack.persistence attack.g0064 attack.t1543.003 detection.emerging_threats ·
Share on:

This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

Read More
Turla PNG Dropper Service

Oct 26, 2023 · attack.persistence attack.g0010 attack.t1543.003 detection.emerging_threats ·
Share on:

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Read More
Turla Service Install

Oct 26, 2023 · attack.persistence attack.g0010 attack.t1543.003 detection.emerging_threats ·
Share on:

This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

Read More
PowerShell Module File Created By Non-PowerShell Process

Oct 23, 2023 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

Read More
Add User to Local Administrators Group

Oct 18, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects suspicious command line that adds an account to the local administrators/administrateurs group

Read More
Antivirus Web Shell Detection

Oct 18, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big webshell repo from e.g. github and checking the matches.

Read More
Azure Kubernetes CronJob

Oct 18, 2023 · attack.persistence attack.t1053.003 attack.privilege_escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
BITS Transfer Job Download From Direct IP

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.t1197 ·
Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

Read More
Common Autorun Keys Modification

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Creation Of Non-Existent System DLL

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects the creation of system dlls that are not present on the system. Usually to achieve dll hijacking

Read More
CurrentVersion Autorun Keys Modification

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion NT Autorun Keys Modification

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Failed Logon From Public IP

Oct 18, 2023 · attack.initial_access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·
Share on:

A login from a public IP can indicate a misconfigured firewall or network boundary.

Read More
FlowCloud Malware

Oct 18, 2023 · attack.persistence attack.t1112 ·
Share on:

Detects FlowCloud malware from threat group TA410.

Read More
Narrator's Feedback-Hub Persistence

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects abusing Windows 10 Narrator's Feedback-Hub

Read More
New DLL Added to AppInit_DLLs Registry Key

Oct 18, 2023 · attack.persistence attack.t1546.010 ·
Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Read More
New RUN Key Pointing to Suspicious Folder

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Read More
New User Created Via Net.EXE

Oct 18, 2023 · attack.persistence attack.t1136.001 ·
Share on:

Identifies the creation of local users via the net.exe command.

Read More
New User Created Via Net.EXE With Never Expire Option

Oct 18, 2023 · attack.persistence attack.t1136.001 ·
Share on:

Detects creation of local users via the net.exe command with the option "never expire"

Read More
Office Autorun Keys Modification

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Password Provided In Command Line Of Net.EXE

Oct 18, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
Potential Persistence Attempt Via Existing Service Tampering

Oct 18, 2023 · attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential Persistence Via COM Search Order Hijacking

Oct 18, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking leveraging the COM Search Order

Read More
Potential Persistence Via Microsoft Office Startup Folder

Oct 18, 2023 · attack.persistence attack.t1137 ·
Share on:

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Read More
Potential Webshell Creation On Static Website

Oct 18, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Read More
PUA - Process Hacker Execution

Oct 18, 2023 · attack.defense_evasion attack.discovery attack.persistence attack.privilege_escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors regularly abuse it to manipulate system processes.

Read More
PUA - System Informer Execution

Oct 18, 2023 · attack.persistence attack.privilege_escalation attack.discovery attack.defense_evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
Register New IFiltre For Persistence

Oct 18, 2023 · attack.persistence ·
Share on:

Detects when an attacker register a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files

Read More
Registry Persistence via Explorer Run Key

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Read More
Remote Task Creation via ATSVC Named Pipe - Zeek

Oct 18, 2023 · attack.lateral_movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Remote Utilities Host Service Install

Oct 18, 2023 · attack.persistence ·
Share on:

Detects Remote Utilities Host service installation on the target system.

Read More
Scheduled Task Executed From A Suspicious Location

Oct 18, 2023 · attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Read More
Scheduled Task Executed Uncommon LOLBIN

Oct 18, 2023 · attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Read More
Suspicious Add User to Remote Desktop Users Group

Oct 18, 2023 · attack.persistence attack.lateral_movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects suspicious command line in which a user gets added to the local Remote Desktop Users group

Read More
Suspicious Environment Variable Has Been Registered

Oct 18, 2023 · attack.defense_evasion attack.persistence ·
Share on:

Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings

Read More
Suspicious WindowsTerminal Child Processes

Oct 18, 2023 · attack.execution attack.persistence ·
Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Read More
Sysinternals PsService Execution

Oct 18, 2023 · attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Read More
Sysinternals PsSuspend Execution

Oct 18, 2023 · attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read More
Tasks Folder Evasion

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.execution attack.t1574.002 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Third Party Software DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Read More
VMToolsd Suspicious Child Process

Oct 18, 2023 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Read More
WMI Persistence

Oct 18, 2023 · attack.persistence attack.privilege_escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
Wow6432Node CurrentVersion Autorun Keys Modification

Oct 18, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abuse of Service Permissions to Hide Services Via Set-Service - PS

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
Added Credentials to Existing Application

Oct 17, 2023 · attack.t1098.001 attack.persistence ·
Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Read More
Anydesk Remote Access Software Service Installation

Oct 17, 2023 · attack.persistence ·
Share on:

Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

Read More
Application AppID Uri Configuration Changes

Oct 17, 2023 · attack.persistence attack.credential_access attack.privilege_escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application URI Configuration Changes

Oct 17, 2023 · attack.t1528 attack.t1078.004 attack.persistence attack.credential_access attack.privilege_escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
Application Using Device Code Authentication Flow

Oct 17, 2023 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Oct 17, 2023 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
Azure Kubernetes Admission Controller

Oct 17, 2023 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Bitsadmin to Uncommon IP Server Address

Oct 17, 2023 · attack.command_and_control attack.t1071.001 attack.defense_evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read More
Bulk Deletion Changes To Privileged Account Permissions

Oct 17, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Read More
CA Policy Removed by Non Approved Actor

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
Changes To PIM Settings

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1078.004 ·
Share on:

Detects when changes are made to PIM roles

Read More
Creation of a Local Hidden User Account by Registry

Oct 17, 2023 · attack.persistence attack.t1136.001 ·
Share on:

Sysmon registry detection of a local hidden user account.

Read More
Creation of an WerFault.exe in Unusual Folder

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.t1574.001 ·
Share on:

Detects WerFault copoed to a suspicious folder, which could be a sign of WerFault DLL hijacking

Read More
DLL Search Order Hijackig Via Additional Space in Path

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.002 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading Of ShellChromeAPI.DLL

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Failed MSExchange Transport Agent Installation

Oct 17, 2023 · attack.persistence attack.t1505.002 ·
Share on:

Detects a failed installation of a Exchange Transport Agent

Read More
Google Cloud Kubernetes Admission Controller

Oct 17, 2023 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Guest User Invited By Non Approved Inviters

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.t1078.004 ·
Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Read More
Malicious DLL File Dropped in the Teams or OneDrive Folder

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.002 ·
Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file (“iphlpapi.dll”) is sideloaded

Read More
Modifying Crontab

Oct 17, 2023 · attack.persistence attack.t1053.003 ·
Share on:

Detects suspicious modification of crontab file.

Read More
Moriya Rootkit - System

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·
Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Read More
MSSQL Add Account To Sysadmin Role

Oct 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

Read More
MSSQL SPProcoption Set

Oct 17, 2023 · attack.persistence ·
Share on:

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

Read More
NetSupport Manager Service Install

Oct 17, 2023 · attack.persistence ·
Share on:

Detects NetSupport Manager service installation on the target system.

Read More
New Kernel Driver Via SC.EXE

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
Password Reset By User Account

Oct 17, 2023 · attack.persistence attack.credential_access attack.t1078.004 ·
Share on:

Detect when a user has reset their password in Azure AD

Read More
Persistence Via TypedPaths - CommandLine

Oct 17, 2023 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

Read More
PIM Alert Setting Changes To Disabled

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
Potential DLL Sideloading Via ClassicExplorer32.dll

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Read More
Potential DLL Sideloading Via comctl32.dll

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Read More
Potential DLL Sideloading Via JsSchHlp

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Read More
Potential Persistence Attempt Via ErrorHandler.Cmd

Oct 17, 2023 · attack.persistence ·
Share on:

Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.

Read More
Potential Privilege Escalation Attempt Via .Exe.Local Technique

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation ·
Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Powerview Add-DomainObjectAcl DCSync AD Extend Right

Oct 17, 2023 · attack.persistence attack.t1098 ·
Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Read More
Privileged Account Creation

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1078.004 ·
Share on:

Detects when a new admin is created.

Read More
Privileged User Has Been Created

Oct 17, 2023 · attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read More
Registry Persistence Mechanisms in Recycle Bin

Oct 17, 2023 · attack.persistence attack.t1547 ·
Share on:

Detects persistence registry keys for Recycle Bin

Read More
RTCore Suspicious Service Installation

Oct 17, 2023 · attack.persistence ·
Share on:

Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse

Read More
Service DACL Abuse To Hide Services Via Sc.EXE

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·
Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Read More
Service Installation in Suspicious Folder

Oct 17, 2023 · attack.persistence attack.privilege_escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation in suspicious folder appdata

Read More
Sticky Key Like Backdoor Usage - Registry

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Suspicious ASPX File Drop by Exchange

Oct 17, 2023 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Read More
Suspicious File Drop by Exchange

Oct 17, 2023 · attack.persistence attack.t1190 attack.initial_access attack.t1505.003 ·
Share on:

Detects suspicious file type dropped by an Exchange component in IIS

Read More
Suspicious Get-Variable.exe Creation

Oct 17, 2023 · attack.persistence attack.t1546 attack.defense_evasion attack.t1027 ·
Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Read More
Suspicious Get-WmiObject

Oct 17, 2023 · attack.persistence attack.t1546 ·
Share on:

The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers

Read More
Suspicious GetTypeFromCLSID ShellExecute

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1546.015 ·
Share on:

Detects suspicious Powershell code that execute COM Objects

Read More
Suspicious GrpConv Execution

Oct 17, 2023 · attack.persistence attack.t1547 ·
Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Read More
Suspicious New Service Creation

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·
Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Read More
Suspicious Processes Spawned by WinRM

Oct 17, 2023 · attack.t1190 attack.initial_access attack.persistence attack.privilege_escalation ·
Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Read More
Suspicious Scheduled Task Creation

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Update

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious Schtasks Execution AppData Folder

Oct 17, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Screensaver Binary File Creation

Oct 17, 2023 · attack.persistence attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet

Oct 17, 2023 · attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Suspicious Service Installation Script

Oct 17, 2023 · attack.persistence attack.privilege_escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation scripts

Read More
Temporary Access Pass Added To An Account

Oct 17, 2023 · attack.persistence attack.t1078.004 ·
Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Read More
UEFI Persistence Via Wpbbin - FileCreation

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.t1542.001 ·
Share on:

Detects creation of a file named "wpbbin" in the "%systemroot%\system32" directory. Which could be indicative of UEFI based persistence method

Read More
UEFI Persistence Via Wpbbin - ProcessCreation

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.t1542.001 ·
Share on:

Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

Read More
User Added To Group With CA Policy Modification Access

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

Read More
User Added To Root/Sudoers Group Using Usermod

Oct 17, 2023 · attack.privilege_escalation attack.persistence ·
Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Read More
User Removed From Group With CA Policy Modification Access

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

Read More
VMGuestLib DLL Sideload

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Read More
Windows Spooler Service Suspicious Binary Load

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574 cve.2021.1675 cve.2021.34527 ·
Share on:

Detect DLL Load from Spooler Service backup folder

Read More
Winlogon Helper DLL

Oct 17, 2023 · attack.persistence attack.t1547.004 ·
Share on:

Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Read More
App Granted Privileged Delegated Or App Permissions

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 ·
Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Read More
AWS ECS Task Definition That Queries The Credential Endpoint

Oct 12, 2023 · attack.persistence attack.t1525 ·
Share on:

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

Read More
AWS ElastiCache Security Group Created

Oct 12, 2023 · attack.persistence attack.t1136 attack.t1136.003 ·
Share on:

Detects when an ElastiCache security group has been created.

Read More
AWS IAM Backdoor Users Keys

Oct 12, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Read More
AWS IAM S3Browser LoginProfile Creation

Oct 12, 2023 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Oct 12, 2023 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Oct 12, 2023 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
AWS Identity Center Identity Provider Change

Oct 12, 2023 · attack.persistence attack.t1556 ·
Share on:

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

Read More
AWS Route 53 Domain Transfer Lock Disabled

Oct 12, 2023 · attack.persistence attack.credential_access attack.t1098 ·
Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More
AWS Route 53 Domain Transferred to Another Account

Oct 12, 2023 · attack.persistence attack.credential_access attack.t1098 ·
Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More
AWS User Login Profile Was Modified

Oct 12, 2023 · attack.persistence attack.t1098 ·
Share on:

An attacker with the iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. With this alert, it is used to detect anyone is changing password on behalf of other users.

Read More
Change to Authentication Method

Oct 12, 2023 · attack.credential_access attack.t1556 attack.persistence attack.defense_evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Disabled MFA to Bypass Authentication Mechanisms

Oct 12, 2023 · attack.persistence attack.t1556 ·
Share on:

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Read More
Disabling Multi Factor Authentication

Oct 12, 2023 · attack.persistence attack.t1556 ·
Share on:

Detects disabling of Multi Factor Authentication.

Read More
Google Cloud Kubernetes CronJob

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Google Workspace Granted Domain API Access

Oct 12, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects when an API access service account is granted domain authority.

Read More
Google Workspace User Granted Admin Privileges

Oct 12, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects when an Google Workspace user is granted admin privileges.

Read More
Granting Of Permissions To An Account

Oct 12, 2023 · attack.persistence attack.t1098.003 ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
New Federated Domain Added

Oct 12, 2023 · attack.persistence attack.t1136.003 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
New Federated Domain Added - Exchange

Oct 12, 2023 · attack.persistence attack.t1136.003 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
Number Of Resource Creation Or Deployment Activities

Oct 12, 2023 · attack.persistence attack.t1098 ·
Share on:

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Read More
User Added to an Administrator's Azure AD Role

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
Control Panel Items

Oct 12, 2023 · attack.execution attack.defense_evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Oct 12, 2023 · attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Leviathan Registry Key Activity

Oct 4, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects registry key used by Leviathan APT in Malaysian focused campaign

Read More
Unsigned Module Loaded by ClickOnce Application

Oct 4, 2023 · attack.persistence attack.t1574.002 ·
Share on:

Detects unsigned module load by ClickOnce application.

Read More
Service Registry Key Read Access Request

Sep 29, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.011 ·
Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Read More
Invalid PIM License

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
Roles Activated Too Frequently

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Stale Accounts In A Privileged Role

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Too Many Global Admins

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Azure AD Threat Intelligence

Sep 11, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Okta Identity Provider Created

Sep 11, 2023 · attack.persistence attack.t1098.001 ·
Share on:

Detects when a new identity provider is created for Okta.

Read More
Pingback Backdoor DLL Loading Activity

Sep 7, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
VMMap Signed Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Read More
VMMap Unsigned Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Read More
ESXi Account Creation Via ESXCLI

Sep 6, 2023 · attack.persistence attack.t1136 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
Activity From Anonymous IP Address

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
Anomalous User Activity

Sep 6, 2023 · attack.t1098 attack.persistence ·
Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Read More
Atypical Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
New Country

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Read More
Suspicious Browser Activity

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Read More
Unfamiliar Sign-In Properties

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·
Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Read More
Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·
Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·
Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Read More
A Member Was Added to a Security-Enabled Global Group

Aug 28, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is added to a security-enabled global group

Read More
A Member Was Removed From a Security-Enabled Global Group

Aug 28, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is removed from a security-enabled global group

Read More
A Security-Enabled Global Group Was Deleted

Aug 28, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects activity when a security-enabled global group is deleted

Read More
HackTool - CrackMapExec Execution

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.credential_access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Aug 28, 2023 · cve.2023.34362 detection.emerging_threats attack.persistence attack.t1505.003 ·
Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Read More
Suspicious Computer Account Name Change CVE-2021-42287

Aug 28, 2023 · cve.2021.42287 detection.emerging_threats attack.defense_evasion attack.persistence attack.t1036 attack.t1098 ·
Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Read More
Suspicious IIS Module Registration

Aug 28, 2023 · attack.persistence attack.t1505.004 ·
Share on:

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Read More
Potential Persistence Via Visual Studio Tools for Office

Aug 28, 2023 · attack.t1137.006 attack.persistence ·
Share on:

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Read More
Root Account Enable Via Dsenableroot

Aug 22, 2023 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial_access attack.persistence ·
Share on:

Detects attempts to enable the root account via "dsenableroot"

Read More
BITS Transfer Job Download From File Sharing Domains

Aug 17, 2023 · attack.defense_evasion attack.persistence attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
Suspicious Download From File-Sharing Website Via Bitsadmin

Aug 17, 2023 · attack.defense_evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Read More
Add Debugger Entry To AeDebug For Persistence

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add Debugger Entry To Hangs Key For Persistence

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add Port Monitor Persistence in Registry

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Bypass UAC Using Event Viewer

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
Changing RDP Port to Non Standard Number

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Classes Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
COM Hijacking via TreatAs

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Read More
CurrentControlSet Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Enable Local Manifest Installation With Winget

Aug 17, 2023 · attack.defense_evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Read More
IE Change Domain Zone

Aug 17, 2023 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Internet Explorer Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Modify User Shell Folders Startup Value

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.001 ·
Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Read More
New ODBC Driver Registered

Aug 17, 2023 · attack.persistence ·
Share on:

Detects the registration of a new ODBC driver.

Read More
Outlook Macro Execution Without Warning Setting Enabled

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Outlook Security Settings Updated - Registry

Aug 17, 2023 · attack.persistence attack.t1137 ·
Share on:

Detects changes to the registry values related to outlook security settings

Read More
Outlook Task/Note Reminder Received

Aug 17, 2023 · attack.persistence attack.t1137 cve.2023.23397 detection.emerging_threats ·
Share on:

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Read More
Persistence Via Disk Cleanup Handler - Autorun

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Persistence Via Hhctrl.ocx

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

Read More
Persistence Via New SIP Provider

Aug 17, 2023 · attack.persistence attack.defense_evasion attack.t1553.003 ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Potential COLDSTEEL RAT Windows User Creation

Aug 17, 2023 · attack.persistence detection.emerging_threats ·
Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Read More
Potential Encrypted Registry Blob Related To SNAKE Malware

Aug 17, 2023 · attack.persistence detection.emerging_threats ·
Share on:

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Read More
Potential Persistence Using DebugPath

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential persistence using Appx DebugPath

Read More
Potential Persistence Via AutodialDLL

Aug 17, 2023 · attack.persistence ·
Share on:

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Read More
Potential Persistence Via CHM Helper DLL

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

Read More
Potential Persistence Via DLLPathOverride

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

Read More
Potential Persistence Via Excel Add-in - Registry

Aug 17, 2023 · attack.persistence attack.t1137.006 ·
Share on:

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Read More
Potential Persistence Via LSA Extensions

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.

Read More
Potential Persistence Via Mpnotify

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Potential Persistence Via MyComputer Registry Keys

Aug 17, 2023 · attack.persistence ·
Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Read More
Potential Persistence Via Outlook Home Page

Aug 17, 2023 · attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook home pages.

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential Persistence Via Outlook Today Pages

Aug 17, 2023 · attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook today pages. An attacker can set a custom page to execute arbitrary code and link to it via the registry key "UserDefinedUrl".

Read More
Potential Persistence Via Scrobj.dll COM Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Read More
Potential Persistence Via Shim Database In Uncommon Location

Aug 17, 2023 · attack.persistence attack.t1546.011 ·
Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Read More
Potential Persistence Via Shim Database Modification

Aug 17, 2023 · attack.persistence attack.t1546.011 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Read More
Potential Persistence Via TypedPaths

Aug 17, 2023 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

Read More
Potential PSFactoryBuffer COM Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Read More
Potential Registry Persistence Attempt Via DbgManagedDebugger

Aug 17, 2023 · attack.persistence attack.t1574 ·
Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Read More
Potential Registry Persistence Attempt Via Windows Telemetry

Aug 17, 2023 · attack.persistence attack.t1053.005 ·
Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Read More
Potentially Suspicious ODBC Driver Registered

Aug 17, 2023 · attack.persistence attack.t1003 ·
Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

Read More
Registry Modification to Hidden File Extension

Aug 17, 2023 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Running Chrome VPN Extensions via the Registry 2 VPN Extension

Aug 17, 2023 · attack.persistence attack.t1133 ·
Share on:

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Read More
Scheduled TaskCache Change by Uncommon Program

Aug 17, 2023 · attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Read More
ServiceDll Hijack

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
Session Manager Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Set TimeProviders DllName

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
Small Sieve Malware Registry Persistence

Aug 17, 2023 · attack.persistence detection.emerging_threats ·
Share on:

Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

Read More
Suspicious New Printer Ports in Registry (CVE-2020-1048)

Aug 17, 2023 · attack.persistence attack.execution attack.defense_evasion attack.t1112 ·
Share on:

Detects a new and suspicious printer port creation in Registry that could be an attempt to exploit CVE-2020-1048

Read More
Suspicious Powershell In Registry Run Keys

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects potential PowerShell commands or code within registry run keys

Read More
Suspicious Shim Database Patching Activity

Aug 17, 2023 · attack.persistence attack.t1546.011 ·
Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Read More
System Scripts Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
VBScript Payload Stored in Registry

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Read More
Winget Admin Settings Modification

Aug 17, 2023 · attack.defense_evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks

Read More
Winlogon AllowMultipleTSSessions Enable

Aug 17, 2023 · attack.persistence attack.defense_evasion attack.t1112 ·
Share on:

Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users

Read More
Winlogon Notify Key Logon Persistence

Aug 17, 2023 · attack.persistence attack.t1547.004 ·
Share on:

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Read More
WinSock2 Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Classes Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Pingback Backdoor Activity

Aug 2, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
New Shim Database Created in the Default Directory

Aug 1, 2023 · attack.persistence attack.t1547.009 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Read More
Potential Shim Database Persistence via Sdbinst.EXE

Aug 1, 2023 · attack.persistence attack.privilege_escalation attack.t1546.011 ·
Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Jul 31, 2023 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Read More
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Jul 27, 2023 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Read More
Potential CCleanerDU.DLL Sideloading

Jul 24, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Read More
Windows Terminal Profile Settings Modification By Uncommon Process

Jul 24, 2023 · attack.persistence attack.t1547.015 ·
Share on:

Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

Read More
Potential CCleanerReactivator.DLL Sideloading

Jul 20, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Read More
Scheduled Task Executing Encoded Payload from Registry

Jul 20, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task Executing Payload from Registry

Jul 20, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Enabled User Right in AD to Control User Objects

Jun 26, 2023 · attack.persistence attack.t1098 ·
Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Read More
Remote Access Tool Services Have Been Installed - Security

Jun 21, 2023 · attack.persistence attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Access Tool Services Have Been Installed - System

Jun 21, 2023 · attack.persistence attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Local User Creation

Jun 21, 2023 · attack.persistence attack.t1136.001 ·
Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Read More
COLDSTEEL Persistence Service Creation

Jun 20, 2023 · attack.defense_evasion attack.persistence detection.emerging_threats ·
Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

Read More
COLDSTEEL RAT Anonymous User Process Execution

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

Read More
COLDSTEEL RAT Cleanup Command Execution

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

Read More
COLDSTEEL RAT Service Persistence Execution

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Read More
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Jun 20, 2023 · attack.initial_access attack.t1190 attack.persistence attack.t1505.003 cve.2021.40539 detection.emerging_threats ·
Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Read More
Defrag Deactivation

Jun 20, 2023 · attack.persistence attack.t1053.005 attack.s0111 detection.emerging_threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Defrag Deactivation - Security

Jun 20, 2023 · attack.persistence attack.t1053 attack.s0111 detection.emerging_threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
DEWMODE Webshell Access

Jun 20, 2023 · attack.persistence attack.t1505.003 detection.emerging_threats ·
Share on:

Detects access to DEWMODE webshell as described in FIREEYE report

Read More
Goofy Guineapig Backdoor Service Creation

Jun 20, 2023 · attack.persistence detection.emerging_threats ·
Share on:

Detects service creation persistence used by the Goofy Guineapig backdoor

Read More
Moriya Rootkit File Created

Jun 20, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 detection.emerging_threats ·
Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Read More
OilRig APT Activity

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
Oracle WebLogic Exploit

Jun 20, 2023 · attack.t1190 attack.initial_access attack.persistence attack.t1505.003 cve.2018.2894 detection.emerging_threats ·
Share on:

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Read More
Pingback Backdoor File Indicators

Jun 20, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Potential ACTINIUM Persistence Activity

Jun 20, 2023 · attack.persistence attack.t1053 attack.t1053.005 detection.emerging_threats ·
Share on:

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Read More
Potential COLDSTEEL Persistence Service DLL Creation

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Read More
Potential COLDSTEEL Persistence Service DLL Load

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Read More
Potential COLDSTEEL RAT File Indicators

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Read More
Potential Ryuk Ransomware Activity

Jun 20, 2023 · attack.persistence attack.t1547.001 detection.emerging_threats ·
Share on:

Detects Ryuk ransomware activity

Read More
Serv-U Exploitation CVE-2021-35211 by DEV-0322

Jun 20, 2023 · attack.persistence attack.t1136.001 cve.2021.35211 detection.emerging_threats ·
Share on:

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Read More
Small Sieve Malware CommandLine Indicator

Jun 20, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·
Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Read More
SNAKE Malware Covert Store Registry Key

Jun 20, 2023 · attack.persistence detection.emerging_threats ·
Share on:

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

Read More
SNAKE Malware Service Persistence

Jun 20, 2023 · attack.persistence detection.emerging_threats ·
Share on:

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

Read More
Solarwinds SUPERNOVA Webshell Access

Jun 20, 2023 · attack.persistence attack.t1505.003 detection.emerging_threats ·
Share on:

Detects access to SUPERNOVA webshell as described in Guidepoint report

Read More
SOURGUM Actor Behaviours

Jun 20, 2023 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege_escalation detection.emerging_threats ·
Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Read More
Suspicious PrinterPorts Creation (CVE-2020-1048)

Jun 20, 2023 · attack.persistence attack.execution attack.t1059.001 cve.2020.1048 detection.emerging_threats ·
Share on:

Detects new commands that add new printer port which point to suspicious file

Read More
Suspicious VBScript UN2452 Pattern

Jun 20, 2023 · attack.persistence attack.t1547.001 detection.emerging_threats ·
Share on:

Detects suspicious inline VBScript keywords as used by UNC2452

Read More
UNC4841 - Barracuda ESG Exploitation Indicators

Jun 20, 2023 · attack.execution attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
UNC4841 - Email Exfiltration File Pattern

Jun 20, 2023 · attack.execution attack.persistence attack.defense_evasion detection.emerging_threats ·
Share on:

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

Read More
Potential 7za.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·
Share on:

Detects potential DLL sideloading of "7za.dll"

Read More
Potential Persistence Via Logon Scripts - CommandLine

Jun 9, 2023 · attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence