attack.t1087.001

Malicious PowerShell Commandlets - ProcessCreation

Dec 1, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Local System Accounts Discovery - Linux

Oct 8, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

BloodHound Collection Files

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Cisco Collect Data

Aug 12, 2024 · attack.discovery attack.credential-access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·

Share on:

Collect pertinent data from the configuration files

HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

Local Accounts Discovery

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1087.001 ·

Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Local System Accounts Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts on MacOS

Malicious PowerShell Commandlets - PoshModule

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 ·

Share on:

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

Aug 12, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Suspicious Use of PsLogList

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·

Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs