attack.t1059.003

Remote Access Tool - ScreenConnect Command Execution

Sep 2, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects command execution via ScreenConnect RMM

Remote Access Tool - ScreenConnect File Transfer

Sep 2, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects file being transferred via ScreenConnect RMM

Remote Access Tool - ScreenConnect Temporary File

Sep 2, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users<username>\Documents\ConnectWiseControl\Temp" before execution.

AWS EC2 Startup Shell Script Change

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·

Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Conhost.exe CommandLine Path Traversal

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Elise Backdoor Activity

Aug 12, 2024 · attack.g0030 attack.g0050 attack.s0081 attack.execution attack.t1059.003 detection.emerging-threats ·

Share on:

Detects Elise backdoor activity used by APT32

Exploited CVE-2020-10189 Zoho ManageEngine

Aug 12, 2024 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020-10189 detection.emerging-threats ·

Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Exploiting SetupComplete.cmd CVE-2019-1378

Aug 12, 2024 · attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·

Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

File Was Not Allowed To Run

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·

Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

HackTool - Jlaive In-Memory Assembly Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

HackTool - RedMimicry Winnti Playbook Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Operator Bloopers Cobalt Strike Commands

Aug 12, 2024 · attack.execution attack.t1059.003 stp.1u ·

Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Operator Bloopers Cobalt Strike Modules

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects Cobalt Strike module/commands accidentally entered in CMD shell

Potential APT FIN7 Exploitation Activity

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1059.003 ·

Share on:

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

Potential Baby Shark Malware Activity

Aug 12, 2024 · attack.execution attack.defense-evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·

Share on:

Detects activity that could be related to Baby Shark malware

Potential CommandLine Path Traversal Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·

Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Powershell Execute Batch Script

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system

Powershell Executed From Headless ConHost Process

Aug 12, 2024 · attack.defense-evasion attack.t1059.001 attack.t1059.003 ·

Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·

Share on:

Detects the execution of AdvancedRun utility

Read Contents From Stdin Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detect the use of "<" to read and potentially execute a file via cmd.exe

Remote Access Tool - ScreenConnect Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1059.003 ·

Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Rorschach Ransomware Execution Activity

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.001 attack.defense-evasion detection.emerging-threats ·

Share on:

Detects Rorschach ransomware execution activity

Sofacy Trojan Loader Activity

Aug 12, 2024 · attack.defense-evasion attack.execution attack.g0007 attack.t1059.003 attack.t1218.011 car.2013-10-002 detection.emerging-threats ·

Share on:

Detects Trojan loader activity as used by APT28

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·

Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

ZxShell Malware

Aug 12, 2024 · attack.execution attack.t1059.003 attack.defense-evasion attack.t1218.011 attack.s0412 attack.g0001 detection.emerging-threats ·

Share on:

Detects a ZxShell start by the called and well-known function name

ms-msdt for RCE - sdiagnhost.exe spawning command

Aug 10, 2024 · attack.execution attack.T1059.003 attack.T1204.002 ·

Share on:

Detecting sdiagnhost.exe executing the POC as a result of vulnerability based on ms-msdt.

ms-msdt for RCE CVE-2022-30190

Aug 10, 2024 · attack.execution attack.T1059.003 attack.T1204.002 ·

Share on:

Detecting the execution of weaponized maldoc or embedded link in outlook that uses ms-msdt scheme to execute code.

Bypassing Security Controls - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1202 ·

Share on:

Adversaries bypass controls using the Windows Command Shell in a plethora of ways, but you can detect the one we see most often with a simple combination of process execution and a corresponding command line. Part of the RedCanary 2024 Threat Detection Report.

Obfuscated Commands - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Detecting obfuscation in the command shell is relatively straightforward, but there are a lot of variations to consider when you’re developing detection coverage. Of course, the process you’re looking for will always be cmd.exe, but the corresponding command line can contain a variety of suspicious characters. The trick is finding the thresholds where the inclusion of obfuscation characters go from normal to anomalous (but benign) to suspicious enough to warrant alerting. The following pseudo-detection logic offers a good starting point for developing detection coverage for obfuscation in the command line. Part of the RedCanary 2024 Threat Detection Report.

Service Control Manager Spawning Command Shell with Suspect Strings

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1569 attack.t1569.002 ·

Share on:

The following pseudo detector should generate an alert when services.exe spawns cmd.exe along with a corresponding echo or /c command, which are common attributes of post exploitation that we’ve seen in association with this technique. Part of the RedCanary 2024 Threat Detection Report.

Unusual or Suspicious Process Ancestry - Command Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 ·

Share on:

We have a lot of detection analytics that seek out suspicious or unusual process lineage spawning or spawning from cmd.exe. Many of them don’t often generate confirmed threat detections but can occasionally raise the flag on important threats, like Exchange compromises. One semi-common pattern in our library of analytics is suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. The following amalgamation of analytics might help you detect a diverse array of malicious activity related to web server compromises. Part of the RedCanary 2024 Threat Detection Report.

Windows Explorer Spawning Command Shell with Start and Exit Commands

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·

Share on:

This detection analytic looks for instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2024 Threat Detection Report.

Windows Scheduled Task Creating Shell

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1053 ·

Share on:

Adversaries frequently establish persistence by using scheduled tasks to launch the Windows Command Shell. Detecting this behavior is relatively straightforward. Part of the RedCanary 2024 Threat Detection Report.

Command Shell Bypassing Security Controls (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects command line strings which indicate potential attempts to bypass controls. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Suspicious Process Ancestry (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects IIS worker process spawning command shell. Part of the RedCanary 2023 Threat Detection Report.

Explorer Spawning CMD With Start/Exit Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2023 Threat Detection Report.

Service Control Manager Spawning Command Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects suspect command line strings in CMD processes spawned by services.exe. Part of the RedCanary 2023 Threat Detection Report.

Windows Scheduled Task Create Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects attempts to establish persistence using schtasks and command shell. Part of the RedCanary 2023 Threat Detection Report.

Operator Bloopers Cobalt Strike Commands

Jan 8, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Operator Bloopers Cobalt Strike Modules

Jan 8, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects use of Cobalt Strike module commands accidentally entered in the CMD shell

Command Shell Bypassing Security Controls

Nov 9, 2022 · attack.execution attack.t1059.003 ·

Share on:

Detects common ways to bypass controls using Windows Command Shell. Inspired by the 2022 Red Canary Threat Detection report.

Command Shell Obfuscated Commands

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Looks for the execution of Windows Command Shell with unusually high counts of characters used for obfuscation. Inspired by the 2022 Red Canary Threat Detection report.

Command Shell Unusual or Suspicious Process Ancestry

Nov 9, 2022 · attack.persistence attack.t1505 attack.execution attack.t1059.003 ·

Share on:

Looks for suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Powershell Obfuscation and Escape Characters

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Looks for the execution of PowerShell with unusually high counts of characters like ^, +, $, and %. Inspired by the 2022 Red Canary Threat Detection report.