attack.t1055.001

HackTool - Potential CobaltStrike Process Injection

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Potential DLL Injection Or Execution Using Tracker.exe

Aug 12, 2024 · attack.defense-evasion attack.t1055.001 ·

Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Renamed Mavinject.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Renamed ZOHO Dctask64 Execution

Aug 12, 2024 · attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·

Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

TAIDOOR RAT DLL Load

Aug 12, 2024 · attack.execution attack.t1055.001 detection.emerging-threats ·

Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Potential Gamarue DLL Filename (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055.001 ·

Share on:

Detects Gamarue DLL filename in command line strings. Part of the RedCanary 2023 Threat Detection Report.