attack.t1012

Azure AD Health Monitoring Agent Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

Azure AD Health Service Agents Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·

Share on:

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

Exports Critical Registry Keys To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·

Share on:

Detects the export of a crital Registry key to a file.

Exports Registry Key To a File

Aug 12, 2024 · attack.exfiltration attack.t1012 ·

Share on:

Detects the export of the target Registry key to a file.

HackTool - PCHunter Execution

Aug 12, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Operation Wocao Activity

Aug 12, 2024 · attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·

Share on:

Detects activity mentioned in Operation Wocao report

Operation Wocao Activity - Security

Aug 12, 2024 · attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·

Share on:

Detects activity mentioned in Operation Wocao report

Potential Baby Shark Malware Activity

Aug 12, 2024 · attack.execution attack.defense-evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·

Share on:

Detects activity that could be related to Baby Shark malware

Potential Configuration And Service Reconnaissance Via Reg.EXE

Aug 12, 2024 · attack.discovery attack.t1012 attack.t1007 ·

Share on:

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

SAM Registry Hive Handle Request

Aug 12, 2024 · attack.discovery attack.t1012 attack.credential-access attack.t1552.002 ·

Share on:

Detects handles requested to SAM registry hive

SysKey Registry Keys Access

Aug 12, 2024 · attack.discovery attack.t1012 ·

Share on:

Detects handle requests and access operations to specific registry keys to calculate the SysKey