attack.t1059

Unusual Parent Process For Cmd.EXE

Dec 6, 2023 · attack.execution attack.t1059 ·

Detects suspicious parent process for cmd.exe

Writing Of Malicious Files To The Fonts Folder

Dec 4, 2023 · attack.t1211 attack.t1059 attack.defense_evasion attack.persistence ·

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Fsutil Behavior Set SymlinkEvaluation

Dec 1, 2023 · attack.execution attack.t1059 ·

Share on:

A symbolic link is a type of file that contains a reference to another file. This is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Nov 15, 2023 · detection.emerging_threats attack.execution attack.t1059 attack.initial_access attack.t1190 cve.2023.22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Nov 15, 2023 · detection.emerging_threats attack.execution attack.t1059 attack.initial_access attack.t1190 cve.2023.22518 ·

Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Perl Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Php Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Ruby Inline Command Execution

Nov 2, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Suspicious Execution via macOS Script Editor

Nov 2, 2023 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Use of Pcalua For Execution

Nov 2, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

DarkGate - Autoit3.EXE Execution Parameters

Oct 26, 2023 · attack.execution attack.t1059 detection.emerging_threats ·

Share on:

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

DarkGate - Autoit3.EXE File Creation By Uncommon Process

Oct 26, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 detection.emerging_threats ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Abusable DLL Potential Sideloading From Suspicious Location

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Elevated System Shell Spawned

Oct 18, 2023 · attack.privilege_escalation attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges.

HackTool - Stracciatella Execution

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1059 attack.t1562.001 ·

Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Potential Netcat Reverse Shell Execution

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

Python Inline Command Execution

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Python Spawning Pretty TTY

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects python spawning a pretty tty which could be indicative of potential reverse shell activity

Script Interpreter Execution From Suspicious Folder

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects a suspicious script execution in temporary folders or folders accessible by environment variables

Suspicious Program Names

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Suspicious Remote Child Process From Outlook

Oct 18, 2023 · attack.execution attack.t1059 attack.t1202 ·

Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Turla Group Lateral Movement

Oct 18, 2023 · attack.g0010 attack.execution attack.t1059 attack.lateral_movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging_threats ·

Share on:

Detects automated lateral movement by Turla group

VMToolsd Suspicious Child Process

Oct 18, 2023 · attack.execution attack.persistence attack.t1059 ·

Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Windows Shell/Scripting Application File Write to Suspicious Folder

Oct 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects Windows shells and scripting applications that write files to suspicious folders

Atlassian Confluence CVE-2022-26134

Oct 17, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2022.26134 ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Azure New CloudShell Created

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

Identifies when a new cloudshell is created inside of Azure portal.

BPFDoor Abnormal Process ID or Lock File Accessed

Oct 17, 2023 · attack.execution attack.t1106 attack.t1059 ·

Share on:

detects BPFDoor .lock and .pid files access in temporary file storage facility

Parent in Public Folder Suspicious Process

Oct 17, 2023 · attack.defense_evasion attack.execution attack.t1564 attack.t1059 ·

Share on:

This rule detects suspicious processes with parent images located in the C:\Users\Public folder

Payload Decoded and Decrypted via Built-in Utilities

Oct 17, 2023 · attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense_evasion attack.s0482 attack.s0402 ·

Share on:

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Python Spawning Pretty TTY on Windows

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

Detects python spawning a pretty tty

Suspicious Java Children Processes

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

Detects java process spawning suspicious children

Suspicious Script Execution From Temp Folder

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

Detects a suspicious script executions from temporary folder

Use of Forfiles For Execution

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

Execute commands and binaries from the context of "forfiles". This is used as a LOLBIN for example to bypass application whitelisting.

Use of FSharp Interpreters

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

The FSharp Interpreters, FsiAnyCpu.exe and FSi.exe, can be used for AWL bypass and is listed in Microsoft recommended block rules.

Use of OpenConsole

Oct 17, 2023 · attack.execution attack.t1059 ·

Share on:

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Windows Defender Exclusions Added - PowerShell

Oct 17, 2023 · attack.defense_evasion attack.t1562 attack.execution attack.t1059 ·

Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

DarkGate Autoit3.exe Execution Parameters

Oct 14, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of the legitimate Autoit3 utility from a suspect parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

Renamed CURL.EXE Execution

Oct 12, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

LOLBIN Execution Of The FTP.EXE Binary

Aug 11, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of ftp.exe script execution with the "-s" or "/s" flag and any child processes ran by ftp.exe

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Jul 31, 2023 · attack.execution attack.persistence attack.t1059 ·

Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Jul 27, 2023 · attack.execution attack.persistence attack.t1059 ·

Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Ursnif Redirection Of Discovery Commands

Jul 17, 2023 · attack.execution attack.T1059 ·

Share on:

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Suspicious Scan Loop Network

Jun 26, 2023 · attack.execution attack.t1059 attack.discovery attack.t1018 ·

Share on:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Lazarus Group Activity

Jun 20, 2023 · attack.g0032 attack.execution attack.t1059 detection.emerging_threats ·

Share on:

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2021.26084 detection.emerging_threats ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Potential CVE-2021-40444 Exploitation Attempt

Jun 20, 2023 · attack.execution attack.t1059 cve.2021.40444 detection.emerging_threats ·

Share on:

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

REvil Kaseya Incident Malware Patterns

Jun 20, 2023 · attack.execution attack.t1059 attack.g0115 detection.emerging_threats ·

Share on:

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

PCRE.NET Package Image Load

Jun 1, 2023 · attack.execution attack.t1059 ·

Share on:

Detects processes loading modules related to PCRE.NET package

Wscript Shell Run In CommandLine

May 17, 2023 · attack.execution attack.t1059 ·

Share on:

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

PowerShell Download and Execution Cradles

May 9, 2023 · attack.execution attack.t1059 ·

Share on:

Detects PowerShell download and execution cradles.

Suspicious File Created In PerfLogs

May 5, 2023 · attack.execution attack.t1059 ·

Share on:

Detects suspicious file based on their extension being created in "C:\PerfLogs". Note that this directory mostly contains ".etl" files

Potential Xterm Reverse Shell

Apr 25, 2023 · attack.execution attack.t1059 ·

Share on:

Detects usage of "xterm" as a potential reverse shell tunnel

Quick Execution of a Series of Suspicious Commands

Apr 21, 2023 · car.2013-04-002 attack.execution attack.t1059 ·

Share on:

Detects multiple suspicious process in a limited timeframe

Add Insecure Download Source To Winget

Apr 19, 2023 · attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

Install New Package Via Winget Local Manifest

Apr 19, 2023 · attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

Add New Download Source To Winget

Apr 18, 2023 · attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new additional download sources

Add Potential Suspicious New Download Source To Winget

Apr 18, 2023 · attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects usage of winget to add new potentially suspicious download sources

Suspicious Greedy Compression Using Rar.EXE

Apr 12, 2023 · attack.execution attack.t1059 ·

Share on:

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Conhost Spawned By Uncommon Parent Process

Apr 11, 2023 · attack.execution attack.t1059 ·

Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Suspicious Browser Child Process - MacOS

Apr 5, 2023 · attack.initial_access attack.execution attack.t1189 attack.t1203 attack.t1059 ·

Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Potential CobaltStrike Process Patterns

Apr 3, 2023 · attack.execution attack.t1059 ·

Share on:

Detects potential process patterns related to Cobalt Strike beacon activity

Potential Dosfuscation Activity

Mar 7, 2023 · attack.execution attack.t1059 ·

Share on:

Detects possible payload obfuscation via the commandline

HackTool - Sliver C2 Implant Activity Pattern

Mar 5, 2023 · attack.execution attack.t1059 ·

Share on:

Detects process activity patterns as seen being used by Sliver C2 framework implants

Suspicious RASdial Activity

Mar 5, 2023 · attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects suspicious process related to rasdial.exe

Sysprep on AppData Folder

Mar 5, 2023 · attack.execution attack.t1059 ·

Share on:

Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

Suspicious Runscripthelper.exe

Mar 2, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Suspicious Installer Package Child Process

Feb 21, 2023 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command_and_control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

PUA - Wsudo Suspicious Execution

Feb 13, 2023 · attack.execution attack.privilege_escalation attack.t1059 ·

Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Outlook EnableUnsafeClientMailRules Setting Enabled

Feb 9, 2023 · attack.execution attack.t1059 attack.t1202 ·

Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Renamed FTP.EXE Execution

Feb 7, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Run PowerShell Script from Redirected Input Stream

Feb 3, 2023 · attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects PowerShell script execution via input stream redirect

Hacktool Ruler

Feb 1, 2023 · attack.discovery attack.execution attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·

Share on:

This events that are generated when using the hacktool Ruler by Sensepost

Suspicious User-Initiated Process Execution on External Drive (Old)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Suspicious User-Initiated Process Execution on External Drive (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Windows Defender AMSI Trigger Detected

Dec 7, 2022 · attack.execution attack.t1059 ·

Share on:

Detects triggering of AMSI by Windows Defender.

Windows Defender Threat Detected

Dec 6, 2022 · attack.execution attack.t1059 ·

Share on:

Detects all actions taken by Windows Defender malware detection engines

Suspicious Command Line Indicating BlackCat Execution

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·

Share on:

Detects process execution with the --access-token flag accompanied by a 64-character alphanumeric string in the space-delimited command-line arguments..

Suspicious Command Line Indicating BlackCat Execution with Get UUID Option

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·

Share on:

Detects process execution with the --access-token flag accompanied by a child process with a 'get uuid' option.

Suspicious Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 ·

Share on:

Looks for look for cmdlets, methods, and switches that may indicate malicious activity. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious WMI-Related Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 attack.t1047 ·

Share on:

Detects potential adversaries using powershell WMI-related cmdlets to query the operating system or execute commands, either locally or remotely. Inspired by the 2022 Red Canary Threat Detection report.