attack.t1090.001 | Detection.FYI

Cloudflared Portable Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of the "cloudflared" binary from a non standard location.

Read More
Cloudflared Quick Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

Read More
Renamed Cloudflared.EXE Execution

Nov 1, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects the execution of a renamed "cloudflared" binary.

Read More
HackTool - SharpChisel Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Sharp Chisel via the commandline arguments

Read More
PUA - Chisel Tunneling Tool Execution

Aug 12, 2024 · attack.command-and-control attack.t1090.001 ·
Share on:

Detects usage of the Chisel tunneling tool via the commandline arguments

Read More
RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

Read More