attack.s0139 | Detection.FYI

Suspicious File Download From File Sharing Websites - File Stream

Aug 23, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Unusual File Download From File Sharing Websites - File Stream

Aug 23, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
HackTool Named File Stream Created

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Read More
Hidden Executable In NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Read More