attack.t1071.001

DNS Query To Devtunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

DNS Query To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Visual Studio Code Tunnel Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Visual Studio Code Tunnel Service Installation

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Visual Studio Code Tunnel Shell Execution

Sep 2, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

APT User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·

Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Chafer Malware URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects HTTP request used by Chafer malware to receive data from its C2.

Change User Agents with WebRequest

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Cloudflared Tunnels Related DNS Requests

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

ComRAT Network Communication

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 ·

Share on:

Detects Turla ComRAT network communication.

Crypto Miner User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Exploit Framework User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

HackTool - BabyShark Agent Default URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects Baby Shark C2 Framework default communication patterns

HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects user agent and URI paths used by empire agents

HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·

Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Malware User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious user agent strings used by malware in proxy logs

Outbound Network Connection Initiated By Microsoft Dialer

Aug 12, 2024 · attack.execution attack.t1071.001 ·

Share on:

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Potential Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

PwnDrp Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·

Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Raw Paste Service Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 attack.defense-evasion ·

Share on:

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Renamed Visual Studio Code Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Suspicious Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Suspicious Curl Change User Agents - Linux

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·

Share on:

Detects a suspicious curl process start on linux with set useragent options

Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters