attack.s0029 | Detection.FYI

Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·
Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Read More
Cicada3301 Ransomware Execution via PSExec

Sep 9, 2024 · attack.execution attack.t1569 attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of a potentially-renamed psexec to run the Cicada3301 ransomware tool.

Read More
CSExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default CSExec service filename which indicates CSExec service installation and execution

Read More
HackTool Service Registration or Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects installation or execution of services

Read More
PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·
Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Read More
PsExec Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default PsExec service filename which indicates PsExec service installation and execution

Read More
PsExec Service Installation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects PsExec service installation and execution events

Read More
PsExec Tool Execution From Suspicious Locations - PipeName

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

Read More
PUA - NirCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Read More
PUA - NirCmd Execution As LOCAL SYSTEM

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution as SYSTEM user

Read More
PUA - NSudo Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NSudo tool for command execution

Read More
PUA - RunXCmd Execution

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

Read More
RemCom Service File Creation

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects default RemCom service filename which indicates RemCom service installation and execution

Read More