attack.t1134.001

Potential Access Token Abuse
May 2, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1134.001 ·
Share on:
Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - System
Apr 14, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·
Share on:
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Potential Meterpreter/CobaltStrike Activity
Mar 5, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·
Share on:
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read More
HackTool - SharpImpersonation Execution
Feb 13, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1134.001 attack.t1134.003 ·
Share on:
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - Impersonate Execution
Feb 8, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1134.001 attack.t1134.003 ·
Share on:
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
Koh Default Named Pipes
Feb 1, 2023 · attack.privilege_escalation attack.credential_access attack.t1528 attack.t1134.001 ·
Share on:
Detects creation of default named pipes used by the Koh tool

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - Security
Nov 30, 2022 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·
Share on:
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More

Potential Access Token Abuse

Meterpreter or Cobalt Strike Getsystem Service Installation - System

Potential Meterpreter/CobaltStrike Activity

HackTool - SharpImpersonation Execution

HackTool - Impersonate Execution

Koh Default Named Pipes

Meterpreter or Cobalt Strike Getsystem Service Installation - Security