attack.t1059.007

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

HackTool - Koadic Execution

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

JXA In-memory Execution Via OSAScript

Aug 12, 2024 · attack.t1059.002 attack.t1059.007 attack.execution ·

Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·

Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Node Process Executions

Aug 12, 2024 · attack.defense-evasion attack.t1127 attack.t1059.007 ·

Share on:

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Potential Dropper Script Execution Via WScript/CScript

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects wscript/cscript executions of scripts located in user directories

Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Potential SquiblyTwo Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

WScript or CScript Dropper - File

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe