attack.t1057

Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

HackTool - PCHunter Execution

Aug 12, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Process Discovery

Aug 12, 2024 · attack.discovery attack.t1057 ·

Share on:

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

Recon Command Output Piped To Findstr.EXE

Aug 12, 2024 · attack.discovery attack.t1057 ·

Share on:

Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Suspicious Process Discovery With Get-Process

Aug 12, 2024 · attack.discovery attack.t1057 ·

Share on:

Get the processes that are running on the local computer.

List remote processes using tasklist

Feb 23, 2024 · attack.discovery attack.t1057 dist.public ·

Share on:

Detecting the use of tasklist to display processes of remote hosts using the /S parameter.