attack.t1072

Restricted Software Access By SRP

Oct 23, 2025 · attack.lateral-movement attack.execution attack.defense-evasion attack.t1072 ·

Detects restricted access to applications by the Software Restriction Policies (SRP) policy

Suspicious Csi.exe Usage

Oct 23, 2025 · attack.lateral-movement attack.execution attack.t1072 attack.defense-evasion attack.t1218 ·

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

PDQ Deploy Remote Adminstartion Tool Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·

Share on:

Detect use of PDQ Deploy remote admin tool

PUA - Radmin Viewer Utility Execution

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1072 ·

Share on:

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines