Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Detect the use of "<" to read and potentially execute a file via cmd.exe

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Detects the use of Jlaive to execute assemblies in a copied PowerShell

Detects various execution patterns of the CrackMapExec pentesting framework

Detects command line parameters used by Koadic hack tool

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Detects use of Cobalt Strike module commands accidentally entered in the CMD shell

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.