attack.t1069.002

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Malicious PowerShell Commandlets - PoshModule

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ProcessCreation

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

PUA - AdFind Suspicious Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·

Share on:

Detects AdFind execution with common flags seen used during attacks

Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087.002 attack.t1069.002 attack.s0039 ·

Share on:

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Renamed AdFind Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

AdFind Discovery

Feb 23, 2024 · attack.discovery attack.t1018 attack.t1482 attack.t1069.002 attack.t1087.002 attack.s0552 ·

Share on:

AdFind has been seen in numerous intrusions. The threat actor(s) ran these commands.