attack.t1105

Insensitive Subfolder Search Via Findstr.EXE

Nov 15, 2023 · attack.defense_evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Remote File Download Via Findstr.EXE

Nov 15, 2023 · attack.defense_evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

AppX Package Installation Attempts Via AppInstaller.EXE

Nov 14, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

File Download And Execution Via IEExec.EXE

Nov 14, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of the IEExec utility to download and execute files

File Download From Browser Process Via Inline URL

Nov 14, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

File Download Via Windows Defender MpCmpRun.EXE

Nov 14, 2023 · attack.defense_evasion attack.t1218 attack.command_and_control attack.t1105 ·

Share on:

Detects the use of Windows Defender MpCmdRun.EXE to download files

Network Connection Initiated By IMEWDBLD.EXE

Nov 14, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects network connections initiated by IMEWDBLD. This might indicate potential abuse to download arbitrary files via this utility

Potential COM Objects Download Cradles Usage - Process Creation

Nov 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Potential COM Objects Download Cradles Usage - PS Script

Nov 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

PowerShell Web Download

Nov 2, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

DarkGate - Autoit3.EXE File Creation By Uncommon Process

Oct 26, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 detection.emerging_threats ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Arbitrary File Download Via GfxDownloadWrapper.EXE

Oct 23, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

File Download From IP Based URL Via CertOC.EXE

Oct 23, 2023 · attack.command_and_control attack.execution attack.t1105 ·

Share on:

Detects when a user downloads a file from an IP based URL using CertOC.exe

File Download via CertOC.EXE

Oct 23, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects when a user downloads a file by using CertOC.exe

Remote File Download Via Desktopimgdownldr Utility

Oct 23, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Microsoft Binary Suspicious Communication Endpoint

Oct 18, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects an executable in the Windows folder accessing suspicious domains

Suspicious Curl File Upload - Linux

Oct 18, 2023 · attack.exfiltration attack.t1567 attack.t1105 ·

Share on:

Detects a suspicious curl process start the adds a file to a web request

Suspicious Download from Office Domain

Oct 18, 2023 · attack.command_and_control attack.t1105 attack.t1608 ·

Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Suspicious Invoke-WebRequest Execution

Oct 18, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Suspicious Invoke-WebRequest Execution With DirectIP

Oct 18, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Suspicious Program Location with Network Connections

Oct 18, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects programs with network connections running in suspicious files system locations

Connection Initiated Via Certutil.EXE

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a network connection initiated by the certutil.exe tool. Attackers can abuse the utility in order to download malware or additional payloads.

Curl Usage on Linux

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Finger.exe Suspicious Invocation

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays

Password Protected ZIP File Opened (Suspicious Filenames)

Oct 17, 2023 · attack.command_and_control attack.defense_evasion attack.t1027 attack.t1105 attack.t1036 ·

Share on:

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Potential Download/Upload Activity Using Type Command

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of the "type" command to download/upload data from WebDAV server

PrintBrm ZIP Creation of Extraction

Oct 17, 2023 · attack.command_and_control attack.t1105 attack.defense_evasion attack.t1564.004 ·

Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Replace.exe Usage

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Script Initiated Connection

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a script interpreter wscript/cscript opening a network connection. Adversaries may use script to download malicious payloads.

Script Initiated Connection to Non-Local Network

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Suspicious Certreq Command to Download

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files

Suspicious Diantz Download and Compress Into a CAB File

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Download and compress a remote file and store it in a cab file on local machine.

Suspicious Dropbox API Usage

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Suspicious Extrac32 Execution

Oct 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Download or Copy file with Extrac32

Autoit3.exe Executable File Creation Matching DarkGate Behavior

Oct 14, 2023 · attack.command_and_control attack.execution attack.t1105 attack.t1059 ·

Share on:

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Browser Execution In Headless Mode

Oct 4, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of Chromium based browser in headless mode

File Download with Headless Browser

Oct 4, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 28, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Potential In-Memory Download And Compile Of Payloads

Aug 22, 2023 · attack.command_and_control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Suspicious Curl.EXE Download

Jun 22, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Greenbug Espionage Group Indicators

Jun 20, 2023 · attack.g0049 attack.execution attack.t1059.001 attack.command_and_control attack.t1105 attack.defense_evasion attack.t1036.005 detection.emerging_threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Download File To Potentially Suspicious Directory Via Wget

Jun 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of wget to download content to a suspicious directory

Wget Creating Files in Tmp Directory

Jun 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Download from Suspicious Dyndns Hosts

May 18, 2023 · attack.defense_evasion attack.command_and_control attack.t1105 attack.t1568 ·

Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

BITSAdmin Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using bitsadmin.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Certutil Downloading Malicious Binaries (RedCanary Threat Detection Report)

May 17, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects attempts to bypass security controls using certutil.exe to download malicious code. Part of the RedCanary 2023 Threat Detection Report.

Possible Raspberry Robin DLL Download Using msiexec (RedCanary Threat Detection Report)

May 10, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects msiexec used to download a potentially-malicious Raspberry Robin DLL. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Exe File Event With System Image

Apr 16, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects potential SMB file creation activity associated with Impacket smbclient.py.

Import LDAP Data Interchange Format File Via Ldifde.EXE

Mar 15, 2023 · attack.command_and_control attack.defense_evasion attack.t1218 attack.t1105 ·

Share on:

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Command Line Execution with Suspicious URL and AppData Strings

Mar 7, 2023 · attack.execution attack.command_and_control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Curl Download And Execute Combination

Mar 7, 2023 · attack.execution attack.t1218 attack.command_and_control attack.t1105 ·

Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Suspicious Desktopimgdownldr Command

Mar 5, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

File Download Using Notepad++ GUP Utility

Mar 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

MsiExec Web Install

Feb 21, 2023 · attack.defense_evasion attack.t1218.007 attack.command_and_control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

PowerShell DownloadFile

Feb 21, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1104 attack.t1105 ·

Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

PUA - Nimgrab Execution

Feb 13, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

Pandemic Registry Key

Feb 1, 2023 · attack.lateral_movement attack.t1105 ·

Share on:

Detects Pandemic Windows Implant

Suspicious Desktopimgdownldr Target File

Feb 1, 2023 · attack.defense_evasion attack.t1105 ·

Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Operator Bring Your Own Tools

Jan 8, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects use of custom scripts i.e. BAT files.

Cisco Stage Data

Jan 4, 2023 · attack.collection attack.lateral_movement attack.command_and_control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Executable Deployment from Remote Share

Nov 29, 2022 · attack.lateral_movement attack.command_and_control attack.t1105 attack.t1021 ·

Share on:

Detects use of the copy utility to deploy executable files from a remote share to a temp directory, such as the procedure performed by Vice Ransomware gang.

BITSAdmin Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of BITSAdmin to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

CertUtil Downloading Malicious Binaries

Nov 9, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects usage of certutil to download malicious code. Inspired by the 2022 Red Canary Threat Detection report.

Executable from Webdav

Oct 25, 2022 · attack.command_and_control attack.t1105 ·

Share on:

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

Remote File Copy

Oct 25, 2022 · attack.command_and_control attack.lateral_movement attack.t1105 ·

Share on:

Detects the use of tools that copy files from or to remote systems