attack.t1083

DirLister Execution

Dec 1, 2023 · attack.discovery attack.t1083 ·

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

PUA - Seatbelt Execution

Dec 1, 2023 · attack.discovery attack.t1526 attack.t1087 attack.t1083 ·

Share on:

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Apt GTFOBin Abuse - Linux

Nov 2, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "apt" and "apt-get" as a GTFOBin to execute and proxy command and binary execution

Capabilities Discovery - Linux

Nov 2, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Potential Discovery Activity Using Find - Linux

Nov 2, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Potential Discovery Activity Using Find - MacOS

Nov 2, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Vim GTFOBin Abuse - Linux

Nov 2, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "vim" and it's siblings as a GTFOBin to execute and proxy command and binary execution

HackTool - PCHunter Execution

Oct 18, 2023 · attack.execution attack.discovery attack.t1082 attack.t1057 attack.t1012 attack.t1083 attack.t1007 ·

Share on:

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Turla Group Lateral Movement

Oct 18, 2023 · attack.g0010 attack.execution attack.t1059 attack.lateral_movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging_threats ·

Share on:

Detects automated lateral movement by Turla group

WannaCry Ransomware Activity

Oct 18, 2023 · attack.lateral_movement attack.t1210 attack.discovery attack.t1083 attack.defense_evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging_threats ·

Share on:

Detects WannaCry ransomware activity

Powershell Sensitive File Discovery

Oct 17, 2023 · attack.discovery attack.t1083 ·

Share on:

Detect adversaries enumerate sensitive files

Viewing remote directories

Jun 11, 2023 · attack.discovery attack.T1083 dist.public ·

Share on:

Detecting the use of dir command to inspect directories on the remote host.

Source Code Enumeration Detection by Keyword

Jan 31, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects source code enumeration that use GET requests by keyword searches in URL strings

Powershell Directory Enumeration

Jan 27, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Cisco Discovery

Jan 4, 2023 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

Powershell File and Directory Discovery

Jan 4, 2023 · attack.discovery attack.t1083 ·

Share on:

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

DirLister Execution

PUA - Seatbelt Execution

Apt GTFOBin Abuse - Linux

Capabilities Discovery - Linux

Potential Discovery Activity Using Find - Linux

Potential Discovery Activity Using Find - MacOS

Vim GTFOBin Abuse - Linux

HackTool - PCHunter Execution

Turla Group Lateral Movement

WannaCry Ransomware Activity

Powershell Sensitive File Discovery

Viewing remote directories

Source Code Enumeration Detection by Keyword

Powershell Directory Enumeration

Cisco Discovery

Powershell File and Directory Discovery

File and Directory Discovery - Linux

File and Directory Discovery - MacOS