attack.t1027.005

HackTool - CrackMapExec PowerShell Obfuscation

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

PUA - DefenderCheck Execution

Aug 12, 2024 · attack.defense-evasion attack.t1027.005 ·

Share on:

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

PUA - Potential PE Metadata Tamper Using Rcedit

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·

Share on:

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Secure Deletion with SDelete

Aug 12, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·

Share on:

Detects renaming of file while deletion with SDelete tool.

Suspicious Use of Rcedit Utility to Alter Executable Metadata

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·

Share on:

Detects the suspicious use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.