attack.t1021.002

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

CobaltStrike Service Installations in Registry

Aug 17, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_cobaltstrike_service_installs.yml) In some SIEM you can catch those events also in HKLM\System\ControlSet001\Services or HKLM\System\ControlSet002\Services, however, this rule is based on a regular sysmon's events.

CSExec Default Named Pipe

Aug 7, 2023 · attack.lateral_movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default CSExec pipe creation

RemCom Default Named Pipe

Aug 7, 2023 · attack.lateral_movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default RemCom pipe creation

SMB Create Remote File Admin Share

Jun 26, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Jun 1, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Default Impacket Service Creation Via Registry Keys (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects registry key creation matching default Impacket default naming convention. Part of the RedCanary 2023 Threat Detection Report.

File Writes Within Admin Shares (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects files written to an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Process Execution from Admin Share (RedCanary Threat Detection Report)

May 10, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects processes executing from an Admin Share. Part of the RedCanary 2023 Threat Detection Report.

Failed Mounting of Hidden Share

Apr 21, 2023 · attack.t1021.002 attack.lateral_movement ·

Share on:

Detects repeated failed (outgoing) attempts to mount a hidden share

Metasploit Or Impacket Service Installation Via SMB PsExec

Apr 21, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

CobaltStrike Service Installations - System

Apr 14, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Rundll32 Execution Without Parameters

Mar 16, 2023 · attack.lateral_movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·

Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

First Time Seen Remote Named Pipe

Mar 14, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

T1047 Wmiprvse Wbemcomn DLL Hijack

Feb 27, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Feb 7, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Protected Storage Service Access

Feb 7, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Wmiprvse Wbemcomn DLL Hijack

Feb 7, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Wmiprvse Wbemcomn DLL Hijack - File

Feb 7, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Access to ADMIN$ Share

Feb 1, 2023 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects access to $ADMIN share

CobaltStrike Service Installations - Security

Feb 1, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

First Time Seen Remote Named Pipe - Zeek

Dec 27, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Suspicious PsExec Execution - Zeek

Dec 27, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Potential DCOM InternetExplorer.Application DLL Hijack

Dec 18, 2022 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

DCERPC SMB Spoolss Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Impacket PsExec Execution

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects execution of Impacket's psexec.py.

Remote Service Activity via SVCCTL Named Pipe

Oct 25, 2022 · attack.lateral_movement attack.persistence attack.t1021.002 ·

Share on:

Detects remote service activity via remote access to the svcctl named pipe

Suspicious PsExec Execution

Oct 25, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Metasploit SMB Authentication

Oct 14, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Alerts on Metasploit host's authentications on the domain.

SMB Spoolss Name Piped Usage

Oct 9, 2022 · attack.lateral_movement attack.t1021.002 ·

Share on:

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.