attack.t1021.002

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

First Time Seen Remote Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

First Time Seen Remote Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

HackTool - SharpMove Tool Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

Impacket PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects execution of Impacket's psexec.py.

Metasploit Or Impacket Service Installation Via SMB PsExec

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Metasploit SMB Authentication

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Alerts on Metasploit host's authentications on the domain.

Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

Potential CobaltStrike Service Installations - Registry

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Potential DCOM InternetExplorer.Application DLL Hijack

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Protected Storage Service Access

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

PUA - CSExec Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default CSExec pipe creation

PUA - RemCom Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default RemCom pipe creation

Remote Service Activity via SVCCTL Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence attack.t1021.002 ·

Share on:

Detects remote service activity via remote access to the svcctl named pipe

Rundll32 Execution Without Parameters

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Rundll32 UNC Path Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1021.002 attack.t1218.011 ·

Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

SMB Create Remote File Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

SMB Spoolss Name Piped Usage

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

smbexec.py Service Installation

Aug 12, 2024 · attack.lateral-movement attack.execution attack.t1021.002 attack.t1569.002 ·

Share on:

Detects the use of smbexec.py tool by detecting a specific service installation

Suspicious New-PSDrive to Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Suspicious PsExec Execution

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Suspicious PsExec Execution - Zeek

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

T1047 Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

Turla Group Lateral Movement

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059 attack.lateral-movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging-threats ·

Share on:

Detects automated lateral movement by Turla group

Windows Admin Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when an admin share is mounted using net.exe

Windows Internet Hosted WebDav Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Windows Share Mount Via Net.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 ·

Share on:

Detects when a share is mounted using the "net.exe" utility

Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Wmiprvse Wbemcomn DLL Hijack - File

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.