attack.s0357 | Detection.FYI

Atexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

This detection analytic identifies Impacket’s atexec.py script on a target host. atexec.py is remotely run on an adversary’s machine to execute commands on the victim via scheduled task. The command is commonly executed by a non-interactive cmd.exe with the output redirected to an eight-character TMP file. Part of the RedCanary 2024 Threat Detection Report.

Read More
Secretsdump.py Execution

Mar 26, 2024 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

This detection analytic identifies Impacket’s secretsdump.py script on a target host, which is the most common script we have observed in customer environments. secretsdump.py is remotely run on an adversary’s machine to steal credentials. The command is commonly executed by svchost.exe, where regsvc.dll is loaded which allows the export of credentials from the registry. The output is redirected to an eight-character TMP file within the System32 directory. Part of the RedCanary 2024 Threat Detection Report.

Read More
SMBexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Similar to the wmiexec.py detector logic, this detection analytic is looking for services.exe spawning cmd.exe with a command line that has the following strings: '/Q', '/c', 'echo',' > ', ' 2>&1'. These strings are unique to the execution of smbexec.py, which allows a semi-interactive shell used through SMB. This script functions similar to psexec.py, but does not write a service binary to disk on the target machine. Part of the RedCanary 2024 Threat Detection Report.

Read More
Wmiexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1047 attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

This detection analytic looks for wmiprvse.exe spawn cmd.exe with the following command line, cmd.exe /Q /c ', ' 1 \\', ' 2 &1. These strings are specific to the execution of wmiexe.py, which allows a semi-interactive shell used via WMI. Part of the RedCanary 2024 Threat Detection Report.

Read More
Possible Impacket DCOMExec Connection Attempt - Zeek

Sep 1, 2023 · attack.s0357 attack.execution attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Detects attempts to connect via DCOM Endpoints, as used by Impacket DCOMExec. This event will occur on successful or unsuccessful attempts using any of the three DCOMExec -object options.

Read More
Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

Read More
Impacket SMBexec.py Execution (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0357 ·
Share on:

Detects execution from Impacket's smbexec.py. Part of the RedCanary 2023 Threat Detection Report.

Read More
Impacket WMIExec.py Execution (RedCanary Threat Detection Report)

May 17, 2023 · attack.s0357 ·
Share on:

Detects execution from Impacket's wmiexec.py. Part of the RedCanary 2023 Threat Detection Report.

Read More
Impacket Atexec.py Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0357 ·
Share on:

Detects execution from Impacket's atexec.py. Part of the RedCanary 2023 Threat Detection Report.

Read More
Impacket AtExec Process Activity

Apr 16, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detect Atexec.py (Impacket) usage to send command output to attacker.

Read More
Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Read More
Suspicious Impacket Pipe Creation - Psexec

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·
Share on:

Detects named pipes created as a result of Impacket PSExec.py usage.

Read More
Suspicious Impacket PSExec Temp Executable File Creation

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·
Share on:

Detects PSExec.py (Impacket) suspicious .exe file creation in Windows directory.

Read More
Impacket AtExec Suspicious Registry Modification

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detects Atexec.py (Impacket) suspicious registry key addition.

Read More
Impacket AtExec Suspicious Temp File Creation

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.

Read More
Possible Impacket AtExec Activity

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·
Share on:

Detect Impacket atexec.py usage in Windows task scheduler logs. If detected, these events will appear to be logged simultaneously and will all contain the same eight-letter task name.

Read More