attack.t1105

Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

Oct 25, 2024 · attack.command-and-control attack.t1105 ·

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

DarkGate - Autoit3.EXE File Creation By Uncommon Process

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 attack.t1059 detection.emerging-threats ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

File Download From IP Based URL Via CertOC.EXE

Sep 2, 2024 · attack.command-and-control attack.execution attack.t1105 ·

Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Aug 23, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

AppX Package Installation Attempts Via AppInstaller.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

Arbitrary File Download Via GfxDownloadWrapper.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Browser Execution In Headless Mode

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of Chromium based browser in headless mode

Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Command Line Execution with Suspicious URL and AppData Strings

Aug 12, 2024 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Curl Download And Execute Combination

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Curl Usage on Linux

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Download File To Potentially Suspicious Directory Via Wget

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of wget to download content to a suspicious directory

Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·

Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Executable from Webdav

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

File Download And Execution Via IEExec.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download and execute files

File Download From Browser Process Via Inline URL

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

File Download Using Notepad++ GUP Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

File Download via CertOC.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects when a user downloads a file by using CertOC.exe

File Download Via Nscurl - MacOS

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 ·

Share on:

Detects the execution of the nscurl utility in order to download files.

File Download Via Windows Defender MpCmpRun.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

File Download with Headless Browser

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Finger.EXE Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Greenbug Espionage Group Indicators

Aug 12, 2024 · attack.g0049 attack.execution attack.t1059.001 attack.command-and-control attack.t1105 attack.defense-evasion attack.t1036.005 detection.emerging-threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Import LDAP Data Interchange Format File Via Ldifde.EXE

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Insensitive Subfolder Search Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Local Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

MsiExec Web Install

Aug 12, 2024 · attack.defense-evasion attack.t1218.007 attack.command-and-control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Network Connection Initiated By IMEWDBLD.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

Outbound Network Connection Initiated By Script Interpreter

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Pandemic Registry Key

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects Pandemic Windows Implant

Password Protected ZIP File Opened (Suspicious Filenames)

Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Potential COM Objects Download Cradles Usage - Process Creation

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential COM Objects Download Cradles Usage - PS Script

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Potential Download/Upload Activity Using Type Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Aug 12, 2024 · attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·

Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

PowerShell DownloadFile

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1104 attack.t1105 ·

Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

PowerShell Web Download

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·

Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

PUA - Nimgrab Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

Remote File Copy

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1105 ·

Share on:

Detects the use of tools that copy files from or to remote systems

Remote File Download Via Desktopimgdownldr Utility

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Remote File Download Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Replace.exe Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Suspicious Certreq Command to Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Suspicious Curl File Upload - Linux

Aug 12, 2024 · attack.exfiltration attack.t1567 attack.t1105 ·

Share on:

Detects a suspicious curl process start the adds a file to a web request

Suspicious Curl.EXE Download

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Suspicious Desktopimgdownldr Command

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Suspicious Desktopimgdownldr Target File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Suspicious Diantz Download and Compress Into a CAB File

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Download and compress a remote file and store it in a cab file on local machine.

Suspicious Download from Office Domain

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.t1608 ·

Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Suspicious Dropbox API Usage

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Suspicious Extrac32 Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Download or Copy file with Extrac32

Suspicious Invoke-WebRequest Execution

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Suspicious Invoke-WebRequest Execution With DirectIP

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Uncommon Network Connection Initiated By Certutil.EXE

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Wget Creating Files in Tmp Directory

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

BITSAdmin Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·

Share on:

It is not unusual for adversaries, including ones who peddle ransomware, to use BITSAdmin to download arbitrary files from the internet in an effort to evade application blocklisting. The following analytic will look for the execution of bitsadmin.exe with command options that suggest a file is being downloaded. Part of the RedCanary 2024 Threat Detection Report.

Certreq Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·

Share on:

Just like certutil, certreq can also be abused by adversaries to download and upload data. The following analytic will look for the execution of certreq.exe with command options that suggest a file is being downloaded. Part of the RedCanary 2024 Threat Detection Report.

CertUtil Downloading Malicious Binaries

Mar 26, 2024 · attack.command_and_control attack.t1105 ·

Share on:

Adversaries often bypass security controls by using the Windows Certificate Utility (certutil.exe) to download malicious code. In general, they leverage certutil.exe along with the -split command-line option. Part of the RedCanary 2024 Threat Detection Report.

Operator Bring Your Own Tools

Feb 23, 2024 · attack.command_and_control attack.t1105 ·

Share on:

Detects use of custom scripts i.e. BAT files.

Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

BITSAdmin Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using bitsadmin.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Certutil Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using certutil.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Possible Raspberry Robin DLL Download Using msiexec (RedCanary Threat Detection Report)

May 10, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects msiexec used to download a potentially-malicious Raspberry Robin DLL. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Exe File Event With System Image

Apr 16, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects potential SMB file creation activity associated with Impacket smbclient.py.

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Executable Deployment from Remote Share

Nov 29, 2022 · attack.lateral_movement attack.command_and_control attack.t1105 attack.t1021 ·

Share on:

Detects use of the copy utility to deploy executable files from a remote share to a temp directory, such as the procedure performed by Vice Ransomware gang.

BITSAdmin Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of BITSAdmin to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

CertUtil Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of certutil to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.