attack.t1059.007 | Detection.FYI

Potential SquiblyTwo Technique Execution
May 26, 2023 · attack.defense_evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:
Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Read More
Cscript/Wscript Uncommon Script Extension Execution
May 17, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Read More
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
May 17, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf) by Wscript/Cscript

Read More
HackTool - CACTUSTORCH Remote Thread Creation
May 5, 2023 · attack.defense_evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:
Detects remote thread creation from CACTUSTORCH as described in references.

Read More
HTML Help HH.EXE Suspicious Child Process
Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read More
Suspicious HH.EXE Execution
Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Read More
Node Process Executions
Mar 5, 2023 · attack.defense_evasion attack.t1127 attack.t1059.007 ·
Share on:
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Read More
MSHTA Suspicious Execution 01
Feb 22, 2023 · attack.defense_evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020.1599 ·
Share on:
Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Read More
Suspicious Installer Package Child Process
Feb 21, 2023 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command_and_control ·
Share on:
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Read More
Suspicious Parent of Csc.exe
Feb 21, 2023 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense_evasion attack.t1218.005 attack.t1027.004 ·
Share on:
Detects a suspicious parent of csc.exe, which could by a sign of payload delivery

Read More
HackTool - Koadic Execution
Feb 11, 2023 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·
Share on:
Detects command line parameters used by Koadic hack tool

Read More
Adwind RAT / JRAT - Registry
Feb 1, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:
Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Adwind RAT / JRAT File Artifact
Feb 1, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:
Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
WScript or CScript Dropper
Feb 1, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:
Detects wscript/cscript executions of scripts located in user directories

Read More
JXA In-memory Execution Via OSAScript
Jan 31, 2023 · attack.t1059.002 attack.t1059.007 attack.execution ·
Share on:
Detects possible malicious execution of JXA in-memory via OSAScript

Read More
File Was Not Allowed To Run
Oct 25, 2022 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·
Share on:
Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

Read More