attack.t1133

ArcSOC.exe Creating Suspicious Files

Nov 25, 2025 · attack.defense-evasion attack.command-and-control attack.persistence attack.t1127 attack.t1105 attack.t1133 ·

Share on:

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates files with suspicious file types, indicating that they may be executables, script files, or otherwise unusual.

FortiGate - New VPN SSL Web Portal Added

Nov 1, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

FortiGate - VPN SSL Settings Modified

Nov 1, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

External Remote RDP Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

External Remote SMB Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Failed Logon From Public IP

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·

Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

OpenCanary - SSH Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

OpenCanary - SSH New Connection Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

OpenCanary - Telnet Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·

Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Remote Access Tool - ScreenConnect Installation Execution

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects ScreenConnect program starts that establish a remote access to a system.

Remote Access Tool - Team Viewer Session Started On Linux Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Remote Access Tool - Team Viewer Session Started On MacOS Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Remote Access Tool - Team Viewer Session Started On Windows Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Running Chrome VPN Extensions via the Registry 2 VPN Extension

Oct 23, 2025 · attack.initial-access attack.persistence attack.t1133 ·

Share on:

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Unusual Child Process of dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Unusual File Deletion by Dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Unusual File Modification by dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·

Share on:

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

User Added to Remote Desktop Users Group

Oct 23, 2025 · attack.initial-access attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·

Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Potential Exploitation of GoAnywhere MFT Vulnerability

Oct 20, 2025 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.persistence attack.t1133 detection.emerging-threats cve.2025-10035 ·

Share on:

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.