attack.t1059.003

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users<username>\Documents\ConnectWiseControl\Temp" before execution.

HackTool - CrackMapExec Execution

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.credential_access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Elise Backdoor Activity

Jun 20, 2023 · attack.g0030 attack.g0050 attack.s0081 attack.execution attack.t1059.003 detection.emerging_threats ·

Share on:

Detects Elise backdoor activity used by APT32

Exploited CVE-2020-10189 Zoho ManageEngine

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020.10189 detection.emerging_threats ·

Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Exploiting SetupComplete.cmd CVE-2019-1378

Jun 20, 2023 · attack.privilege_escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019.1378 detection.emerging_threats ·

Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Rorschach Ransomware Execution Activity

Jun 20, 2023 · attack.execution attack.t1059.003 attack.t1059.001 attack.defense_evasion detection.emerging_threats ·

Share on:

Detects Rorschach ransomware execution activity

ZxShell Malware

Jun 20, 2023 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1218.011 attack.s0412 attack.g0001 detection.emerging_threats ·

Share on:

Detects a ZxShell start by the called and well-known function name

Command Shell Bypassing Security Controls (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects command line strings which indicate potential attempts to bypass controls. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Command Shell Suspicious Process Ancestry (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects IIS worker process spawning command shell. Part of the RedCanary 2023 Threat Detection Report.

Explorer Spawning CMD With Start/Exit Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects instances of explorer.exe spawning cmd.exe along with corresponding start and exit commands that we commonly observe in conjunction with a wide variety of malicious activity. Part of the RedCanary 2023 Threat Detection Report.

Service Control Manager Spawning Command Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects suspect command line strings in CMD processes spawned by services.exe. Part of the RedCanary 2023 Threat Detection Report.

Windows Scheduled Task Create Shell (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects attempts to establish persistence using schtasks and command shell. Part of the RedCanary 2023 Threat Detection Report.

HTML Help HH.EXE Suspicious Child Process

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Suspicious HH.EXE Execution

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Command Line Execution with Suspicious URL and AppData Strings

Mar 7, 2023 · attack.execution attack.command_and_control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Read Contents From Stdin Via Cmd.EXE

Mar 7, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detect the use of "<" to read and potentially execute a file via cmd.exe

HackTool - RedMimicry Winnti Playbook Execution

Mar 2, 2023 · attack.execution attack.defense_evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

HackTool - Jlaive In-Memory Assembly Execution

Feb 22, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects the use of Jlaive to execute assemblies in a copied PowerShell

HackTool - Koadic Execution

Feb 11, 2023 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

Suspicious HWP Sub Processes

Feb 1, 2023 · attack.initial_access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·

Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Powershell Execute Batch Script

Jan 27, 2023 · attack.execution attack.t1059.003 ·

Share on:

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system

Operator Bloopers Cobalt Strike Commands

Jan 8, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Operator Bloopers Cobalt Strike Modules

Jan 8, 2023 · attack.execution attack.t1059.003 ·

Share on:

Detects use of Cobalt Strike module commands accidentally entered in the CMD shell

Command Shell Bypassing Security Controls

Nov 9, 2022 · attack.execution attack.t1059.003 ·

Share on:

Detects common ways to bypass controls using Windows Command Shell. Inspired by the 2022 Red Canary Threat Detection report.

Command Shell Obfuscated Commands

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Looks for the execution of Windows Command Shell with unusually high counts of characters used for obfuscation. Inspired by the 2022 Red Canary Threat Detection report.

Command Shell Unusual or Suspicious Process Ancestry

Nov 9, 2022 · attack.persistence attack.t1505 attack.execution attack.t1059.003 ·

Share on:

Looks for suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Powershell Obfuscation and Escape Characters

Nov 9, 2022 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1027 ·

Share on:

Looks for the execution of PowerShell with unusually high counts of characters like ^, +, $, and %. Inspired by the 2022 Red Canary Threat Detection report.

File Was Not Allowed To Run

Oct 25, 2022 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

ms-msdt for RCE CVE-2022-30190

Jun 2, 2022 · attack.execution attack.T1059.003 attack.T1204.002 ·

Share on:

Detecting the execution of weaponized maldoc or embedded link in outlook that uses ms-msdt scheme to execute code.

ms-msdt for RCE - sdiagnhost.exe spawning command

May 30, 2022 · attack.execution attack.T1059.003 attack.T1204.002 ·

Share on:

Detecting sdiagnhost.exe executing the POC as a result of vulnerability based on ms-msdt.