attack.t1059.005

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Potential APT10 Cloud Hopper Activity

Aug 12, 2024 · attack.execution attack.g0045 attack.t1059.005 detection.emerging-threats ·

Share on:

Detects potential process and execution activity related to APT10 Cloud Hopper operation

Potential Dropper Script Execution Via WScript/CScript

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects wscript/cscript executions of scripts located in user directories

Potential QBot Activity

Aug 12, 2024 · attack.execution attack.t1059.005 detection.emerging-threats ·

Share on:

Detects potential QBot activity by looking for process executions used previously by QBot

Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Potential SquiblyTwo Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Suspicious Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Suspicious Scripting in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1059.005 ·

Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Uncommon Child Process Of BgInfo.EXE

Aug 12, 2024 · attack.execution attack.t1059.005 attack.defense-evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Windows Shell/Scripting Processes Spawning Suspicious Programs

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·

Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

WScript or CScript Dropper - File

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe