attack.t1001.003

ADSI-Cache File Creation By Uncommon Tool

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Suspicious LDAP-Attributes Used

Aug 12, 2024 · attack.t1001.003 attack.command-and-control ·

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

DNSCat2 Powershell Implementation Detection Via Process Creation

Apr 21, 2023 · attack.command_and_control attack.t1071 attack.t1071.004 attack.t1001.003 attack.t1041 ·

Share on:

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.