attack.t1082

HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Bitbucket User Details Export Attempt Detected

Aug 12, 2024 · attack.collection attack.reconnaissance attack.discovery attack.t1213 attack.t1082 attack.t1591.004 ·
Share on:

Detects user data export activity.

Read More
Bitbucket User Permissions Export Attempt

Aug 12, 2024 · attack.reconnaissance attack.t1213 attack.t1082 attack.t1591.004 ·
Share on:

Detects user permission data export attempt.

Read More
Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·
Share on:

Find information about network devices that is not stored in config files

Read More
Container Residence Discovery Via Proc Virtual FS

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Read More
Docker Container Discovery Via Dockerenv Listing

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Read More
HackTool - PCHunter Execution

Aug 12, 2024 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·
Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More
HackTool - winPEAS Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
Network Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·
Share on:

Detects a set of suspicious network related commands often used in recon stages

Read More
OS Architecture Discovery Via Grep

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

Read More
Potential Container Discovery Via Inodes Listing

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Read More
Potential GobRAT File Discovery Via Grep

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of grep to discover specific files created by the GobRAT malware

Read More
Potential Suspicious Activity Using SeCEdit

Aug 12, 2024 · attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
PUA - System Informer Execution

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
Suspicious Execution of Hostname

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Use of hostname to get information

Read More
Suspicious Execution of Systeminfo

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects usage of the "systeminfo" command to retrieve information

Read More
Suspicious Kernel Dump Using Dtrace

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Read More
Suspicious Query of MachineGUID

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Use of reg to get MachineGuid information

Read More
System and Hardware Information Discovery

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects system information discovery commands

Read More
System Disk And Volume Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·
Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Read More
System Information Discovery

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects system information discovery commands

Read More
System Information Discovery - Auditd

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects System Information Discovery commands

Read More
System Information Discovery Using Ioreg

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

Read More
System Information Discovery Using sw_vers

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of "sw_vers" for system information discovery

Read More
System Information Discovery Using System_Profiler

Aug 12, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·
Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Read More
System Information Discovery Via Sysctl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1497.001 attack.discovery attack.t1082 ·
Share on:

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Read More
Uncommon System Information Discovery Via Wmic.EXE

Aug 12, 2024 · attack.discovery attack.t1082 ·
Share on:

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

Read More
Domain User Enumeration Network Recon 01

Oct 18, 2023 · attack.discovery attack.t1087.002 attack.t1082 ·
Share on:

Domain user and group enumeration via network reconnaissance. Seen in APT 29 and other common tactics and actors. Detects a set of RPC (remote procedure calls) used to enumerate a domain controller. The rule was created based off the datasets and hackathon from https://github.com/OTRF/detection-hackathon-apt29

Read More
Suspicious Command Arguments from Explorer or Wermgr

Sep 1, 2023 · attack.discovery attack.t1082 ·
Share on:

Detects the suspicious command line arguments from potentially-injected versions of explorer or wermgr processes.

Read More
Reconnaissance Activity Using BuiltIn Commands

Apr 21, 2023 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·
Share on:

Detects execution of a set of builtin commands often used in recon stages by different attack groups

Read More
Driverquery Lookup

Jan 9, 2023 · attack.discovery attack.t1082 ·
Share on:

Detects use of driverquery to look up the installed and configured drivers as part of host discovery

Read More