attack.t1053

This detection analytic identifies Impacket’s atexec.py script on a target host. atexec.py is remotely run on an adversary’s machine to execute commands on the victim via scheduled task. The command is commonly executed by a non-interactive cmd.exe with the output redirected to an eight-character TMP file. Part of the RedCanary 2024 Threat Detection Report.

Windows Explorer Spawning Command Shell with Start and Exit Commands

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·

Share on:

This detection analytic looks for instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Windows Scheduled Task Creating Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·

Share on:

Adversaries frequently establish persistence by using scheduled tasks to launch the Windows Command Shell. Detecting this behavior is relatively straightforward. Part of the RedCanary 2024 Threat Detection Report.

Impacket AtExec Process Activity

Apr 16, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detect Atexec.py (Impacket) usage to send command output to attacker.

Impacket AtExec Suspicious Registry Modification

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detects Atexec.py (Impacket) suspicious registry key addition.

Impacket AtExec Suspicious Temp File Creation

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.

Possible Impacket AtExec Activity

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detect Impacket atexec.py usage in Windows task scheduler logs. If detected, these events will appear to be logged simultaneously and will all contain the same eight-letter task name.

Suspicious Schtasks Child Process

Nov 19, 2022 · attack.persistence attack.t1053 attack.t1053.005 ·

Share on:

Detects schtasks being run as a child process of explorer.exe to create a schedule task.

Windows Scheduled Task Behaving Improperly or Suspiciously

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·

Share on:

Detects scheduled tasks created with the /create flag and a reference to commonly-abused Windows utilities. Inspired by the 2022 Red Canary Threat Detection report.

Windows Scheduled Task Create Shell

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·

Share on:

Detects creation of scheduled tasks which may establish persistence using the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Windows Scheduled Task Making Suspicious Network Connection

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·

Share on:

Detects scheduled tasks created to reach out to external domains and download arbitrary binaries on a set or recurring schedule. Inspired by the 2022 Red Canary Threat Detection report.