attack.t1055

Network Connections Where There Should Not Be (Notepad)

Sep 1, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for network connections from notepad. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious Child Process Of Wermgr.EXE

Aug 28, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

CobaltStrike Named Pipe Patterns

Aug 8, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Injected Browser Process Spawning Rundll32

Aug 8, 2023 · attack.defense_evasion attack.T1055 ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

CobaltStrike Named Pipe

Aug 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe as used by CobaltStrike

CobaltStrike Named Pipe Pattern Regex

Aug 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

HackTool - EfsPotato Named Pipe Creation

Aug 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hacktool EfsPotato

Malicious Named Pipe Created

Aug 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

APT PRIVATELOG Image Load Pattern

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 detection.emerging_threats ·

Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Potential Dridex Activity

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging_threats ·

Share on:

Detects potential Dridex acitvity via specific process patterns

Dllhost.EXE Execution Anomaly

May 15, 2023 · attack.defense_evasion attack.t1055 ·

Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Powershell Injecting Into Anything (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.

Process Executing Sans Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects processes running without command lines, which can indicate process injection. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Network Connections (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects notepad making network connections, a potential process injection signal. Part of the RedCanary 2023 Threat Detection Report.

Remote Thread Creation By Uncommon Source Image

May 5, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1055 ·

Share on:

Detects uncommon processes creating remote threads

Potential DLL Sideloading Using Coregen.exe

Mar 15, 2023 · attack.defense_evasion attack.t1218 attack.t1055 ·

Share on:

Detect usage of DLL "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Process Creation Using Sysnative Folder

Mar 5, 2023 · attack.t1055 ·

Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Suspect Svchost Activity

Mar 2, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

DotNet CLR DLL Loaded By Scripting Applications

Feb 23, 2023 · attack.execution attack.privilege_escalation attack.t1055 ·

Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Potential Process Injection Via Msra.EXE

Feb 21, 2023 · attack.defense_evasion attack.t1055 ·

Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Suspicious Rundll32 Invoking Inline VBScript

Feb 21, 2023 · attack.defense_evasion attack.t1055 ·

Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

HackTool - DInjector PowerShell Cradle Execution

Feb 5, 2023 · attack.defense_evasion attack.t1055 ·

Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Malware Shellcode in Verclsid Target Process

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

PowerShell ShellCode

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.execution attack.t1059.001 ·

Share on:

Detects Base64 encoded Shellcode

Suspicious Userinit Child Process

Feb 1, 2023 · attack.defense_evasion attack.t1055 ·

Share on:

Detects a suspicious child process of userinit

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Jan 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Potential Shellcode Injection

Dec 23, 2022 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects potential shellcode injection used by tools such as Metasploit's migrate and Empire's psinject

PowerShell Injecting into Other Process

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for process access activity where PowerShell is accessing any other processes. Inspired by the 2022 Red Canary Threat Detection report.

Process Execution sans Command Lines

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for process execution with no command line arguments, which may indicate process injection. Inspired by the 2022 Red Canary Threat Detection report.

Microsoft Sync Center Suspicious Network Connections

Oct 26, 2022 · attack.t1055 attack.t1218 attack.execution attack.defense_evasion ·

Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Notepad Making Network Connection

Oct 26, 2022 · attack.command_and_control attack.execution attack.defense_evasion attack.t1055 ·

Share on:

Detects suspicious network connection by Notepad

Created Files by Microsoft Sync Center

Oct 26, 2022 · attack.t1055 attack.t1218 attack.execution attack.defense_evasion ·

Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)