attack.t1087.001 | Detection.FYI

Malicious PowerShell Commandlets - PoshModule
May 15, 2023 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:
Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Commandlets - ProcessCreation
Apr 21, 2023 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:
Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Commandlets - ScriptBlock
Apr 21, 2023 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:
Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
BloodHound Collection Files
Apr 11, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:
Detects default file names outputted by the BloodHound collection tool SharpHound

Read More
Suspicious Group And Account Reconnaissance Activity Using Net.EXE
Mar 2, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 ·
Share on:
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE

Read More
Suspicious Use of PsLogList
Feb 24, 2023 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·
Share on:
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Read More
Local Accounts Discovery
Feb 21, 2023 · attack.discovery attack.t1033 attack.t1087.001 ·
Share on:
Local accounts, System Owner/User discovery using operating systems utilities

Read More
Net.exe Execution
Feb 21, 2023 · attack.discovery attack.t1007 attack.t1049 attack.t1018 attack.t1135 attack.t1201 attack.t1069.001 attack.t1069.002 attack.t1087.001 attack.t1087.002 attack.lateral_movement attack.t1021.002 attack.s0039 ·
Share on:
Detects execution of Net.exe, whether suspicious or benign.

Read More
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
Feb 13, 2023 · attack.discovery attack.t1087.001 ·
Share on:
Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Read More
HackTool - Bloodhound/Sharphound Execution
Feb 4, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·
Share on:
Detects command line parameters used by Bloodhound and Sharphound hack tools

Read More
Cisco Collect Data
Jan 4, 2023 · attack.discovery attack.credential_access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·
Share on:
Collect pertinent data from the configuration files

Read More
Local System Accounts Discovery - Linux
Nov 28, 2022 · attack.discovery attack.t1087.001 ·
Share on:
Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Read More
Local System Accounts Discovery - MacOs
Nov 28, 2022 · attack.discovery attack.t1087.001 ·
Share on:
Detects enumeration of local systeam accounts on MacOS

Read More