attack.t1007

HackTool - PCHunter Execution

Nov 25, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

ESXi Network Configuration Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi System Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM List Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Nov 20, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Crontab Enumeration

Aug 12, 2024 · attack.discovery attack.t1007 ·

Share on:

Detects usage of crontab to list the tasks of the user

Potential Configuration And Service Reconnaissance Via Reg.EXE

Aug 12, 2024 · attack.discovery attack.t1012 attack.t1007 ·

Share on:

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.