attack.t1041

Equation Group C2 Communication

Aug 12, 2024 · attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Network Communication Initiated To Portmap.IO Domain

Aug 12, 2024 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·

Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

OpenCanary - TFTP Request

Aug 12, 2024 · attack.exfiltration attack.t1041 ·

Share on:

Detects instances where a TFTP service on an OpenCanary node has had a request.

DNSCat2 Powershell Implementation Detection Via Process Creation

Apr 21, 2023 · attack.command_and_control attack.t1071 attack.t1071.004 attack.t1001.003 attack.t1041 ·

Share on:

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.