attack.t1057

Recon Command Output Piped To Findstr.EXE

Nov 15, 2023 · attack.discovery attack.t1057 ·

Detects the excution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this to extract specific information they require in their chain.

HackTool - PCHunter Execution

Oct 18, 2023 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

List remote processes using tasklist

Jun 11, 2023 · attack.discovery attack.T1057 dist.public ·

Share on:

Detecting the use of tasklist to display processes of remote hosts using the /S parameter.

Suspicious Tasklist Discovery Command

Feb 21, 2023 · attack.discovery attack.t1057 ·

Share on:

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

Suspicious Process Discovery With Get-Process

Jan 27, 2023 · attack.discovery attack.t1057 ·

Share on:

Get the processes that are running on the local computer.

Cisco Discovery

Jan 4, 2023 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

Process Discovery

Oct 25, 2022 · attack.discovery attack.t1057 ·

Share on:

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network