attack.t1055.001 | Detection.FYI

TAIDOOR RAT DLL Load

Jun 20, 2023 · attack.execution attack.t1055.001 detection.emerging_threats ·
Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Read More
Potential Gamarue DLL Filename (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055.001 ·
Share on:

Detects Gamarue DLL filename in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Read More
HackTool - Potential CobaltStrike Process Injection

May 5, 2023 · attack.defense_evasion attack.t1055.001 ·
Share on:

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Read More
ZOHO Dctask64 Process Injection

Mar 5, 2023 · attack.defense_evasion attack.t1055.001 ·
Share on:

Detects suspicious process injection using ZOHO's dctask64.exe

Read More
Renamed ZOHO Dctask64 Execution

Feb 13, 2023 · attack.defense_evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·
Share on:

Detects a renamed dctask64.exe used for process injection, command execution, process creation with a signed binary by ZOHO Corporation

Read More
Renamed Mavinject.EXE Execution

Feb 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More
CreateRemoteThread API and LoadLibrary

Feb 7, 2023 · attack.defense_evasion attack.t1055.001 ·
Share on:

Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process

Read More
Potential DLL Injection Or Execution Using Tracker.exe

Jan 9, 2023 · attack.defense_evasion attack.t1055.001 ·
Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Read More
Mavinject Inject DLL Into Running Process

Dec 6, 2022 · attack.defense_evasion attack.privilege_escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Read More