attack.t1087

HackTool - SOAPHound Execution

Aug 29, 2024 · attack.discovery attack.t1087 ·

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Uncommon Connection to Active Directory Web Services

Aug 29, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Chopper Webshell Process Pattern

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

HackTool - winPEAS Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1082 attack.t1087 attack.t1046 ·

Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Hacktool Ruler

Aug 12, 2024 · attack.discovery attack.execution attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·

Share on:

This events that are generated when using the hacktool Ruler by Sensepost

Malicious PowerShell Commandlets - PoshModule

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ProcessCreation

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Network Reconnaissance Activity

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·

Share on:

Detects a set of suspicious network related commands often used in recon stages

Potential Pikabot Discovery Activity

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·

Share on:

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

PUA - Seatbelt Execution

Aug 12, 2024 · attack.discovery attack.t1526 attack.t1087 attack.t1083 ·

Share on:

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

SharpHound Recon Account Discovery

Aug 12, 2024 · attack.t1087 attack.discovery ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Suspicious Use of PsLogList

Aug 12, 2024 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·

Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Webshell Detection With Command Line Keywords

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Webshell Hacking Activity Patterns

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Execution of SOAPHound Tool with Specific Arguments

Aug 10, 2024 · attack.discovery attack.t1087 ·

Share on:

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

WMI Reconnaissance

Mar 26, 2024 · attack.execution attack.t1047 attack.discovery attack.t1087 attack.t1087.002 ·

Share on:

Reconnaissance is harder to detect because it looks very similar to normal admin behavior. Even so, we detect a relatively high volume of adversaries leveraging WMI to quickly gather domain information such as users, groups, or computers in the domain. The following may help you detect related activity. Part of the RedCanary 2024 Threat Detection Report.

Reconnaissance Activity Using BuiltIn Commands

Apr 21, 2023 · attack.discovery attack.t1087 attack.t1082 car.2016-03-001 ·

Share on:

Detects execution of a set of builtin commands often used in recon stages by different attack groups