attack.t1036

Sdiagnhost Calling Suspicious Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·

Share on:

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

CodePage Modification Via MODE.COM To Russian Language

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

CreateDump Process Dump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Explorer Process Tree Break

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Findstr Launching .lnk File

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1202 attack.t1027.003 ·

Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Forfiles.EXE Child Process Masquerading

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

HackTool - XORDump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects suspicious use of XORDump process memory dumping utility

Interactive Bash Suspicious Children

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.004 attack.t1036 ·

Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

New or Renamed User Account with '$' Character

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.

New Process Created Via Taskmgr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

Password Protected ZIP File Opened (Suspicious Filenames)

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Potential Command Line Path Traversal Evasion Attempt

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

Potential Fake Instance Of Hxtsr.EXE Executed

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe

Potential Homoglyph Attack Using Lookalike Characters

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Potential Homoglyph Attack Using Lookalike Characters in Filename

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Potential LSASS Process Dump Via Procdump

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.credential-access attack.t1003.001 car.2013-05-009 ·

Share on:

Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable.

Potential ReflectDebugger Content Execution Via WerFault.EXE

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1036 ·

Share on:

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

Potential SysInternals ProcDump Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Potentially Suspicious Execution From Tmp Folder

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a potentially suspicious execution of a process located in the '/tmp/' folder

Procdump Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects usage of the SysInternals Procdump utility

Process Execution From A Potentially Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects a potentially suspicious execution from an uncommon folder.

Process Memory Dump Via Comsvcs.DLL

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 car.2013-05-009 ·

Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

PUA - Potential PE Metadata Tamper Using Rcedit

Aug 12, 2024 · attack.defense-evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·

Share on:

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Renamed CreateDump Utility Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Renamed Plink Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of a renamed version of the Plink binary

Renamed ZOHO Dctask64 Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·

Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Suspicious Calculator Usage

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

Suspicious CodePage Switch Via CHCP

Aug 12, 2024 · attack.t1036 attack.defense-evasion ·

Share on:

Detects a code page switch in command line or batch scripts to a rare language

Suspicious Computer Account Name Change CVE-2021-42287

Aug 12, 2024 · cve.2021-42287 detection.emerging-threats attack.defense-evasion attack.persistence attack.t1036 attack.t1098 ·

Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Suspicious DumpMinitool Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1003.001 ·

Share on:

Detects suspicious ways to use the "DumpMinitool.exe" binary

Suspicious MSDT Parent Process

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1218 ·

Share on:

Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation

Suspicious Process Parents

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects suspicious parent processes that should not have any children or should only have a single possible child program

Suspicious Process Start Locations

Aug 12, 2024 · attack.defense-evasion attack.t1036 car.2013-05-002 ·

Share on:

Detects suspicious process run from unusual locations

Suspicious Windows Update Agent Empty Cmdline

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

System Control Panel Item Loaded From Uncommon Location

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

System File Execution Location Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.

Taskmgr as LOCAL_SYSTEM

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM

Windows Binaries Write Suspicious Extensions

Aug 12, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects Windows executables that write files with suspicious extensions

Processes Executing with Unusual Command Lines

Mar 26, 2024 · attack.defense_evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects powershell command lines used with a process name besides powershell. Part of the RedCanary 2024 Threat Detection Report.

Unexpected Internal Process Name

Mar 26, 2024 · attack.defense_evasion attack.t1036 attack.t1036.003 ·

Share on:

Detects instances where the powershell process is renamed to notepad for defense evasion. Part of the RedCanary 2024 Threat Detection Report.

Gootloader JavaScript Execution in AppData Folder (RedCanary Threat Detection Report)

May 17, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects execution of JavaScript (.js) files located in the AppData folder. Part of the RedCanary 2023 Threat Detection Report.

Potential Homoglyph Attack Using Lookalike Characters

May 10, 2023 · attack.defense_evasion attack.t1036 attack.t1036.003 attack.t1036.008 ·

Share on:

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Windows Scripting Host Executing JScript Files with MS-DOS Short Names (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Windows scripting host executing JavaScript files with MS-DOS shortname formatting, a technique associated with Gootloader. Part of the RedCanary 2023 Threat Detection Report.

Process Creation With Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.007 ·

Share on:

Detects process creation utilizing double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Suspicious Command Line Containing Right-to-Left Override

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.002 ·

Share on:

Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.

Bumblebee WmiPrvSE execution pattern

Jan 8, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects Bumblebee WmiPrvSE parent process manipulation

Suspicious Use of Rcedit Utility to Alter Executable Metadata

Dec 12, 2022 · attack.defense_evasion attack.t1036.003 attack.t1036 attack.t1027.005 attack.t1027 ·

Share on:

Detects the suspicious use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.