attack.t1135 | Detection.FYI

File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Aug 29, 2024 · attack.discovery attack.t1135 ·
Share on:

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

Read More
HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Potential Dridex Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging-threats ·
Share on:

Detects potential Dridex acitvity via specific process patterns

Read More
PUA - Advanced IP Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Read More
PUA - Advanced Port Scanner Execution

Aug 12, 2024 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced Port Scanner.

Read More
Turla Group Lateral Movement

Aug 12, 2024 · attack.g0010 attack.execution attack.t1059 attack.lateral-movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging-threats ·
Share on:

Detects automated lateral movement by Turla group

Read More
Using explorer.exe to open a file explorer folder via command prompt

Aug 10, 2024 · attack.Discovery attack.T1135 ·
Share on:

Detects the initial execution of cmd.exe which spawns explorer.exe with the appropriate command line arguments for opening the My Computer folder.

Read More
Invoke-ShareFinder Discovery Activity

Feb 23, 2024 · attack.discovery attack.t1135 ·
Share on:

Use of Invoke-ShareFinder detected via PowerShell logging

Read More
Invoke-ShareFinder Discovery Activity

Feb 23, 2024 · attack.discovery attack.t1135 ·
Share on:

Use of Invoke-ShareFinder detected via PowerShell Script Block logging

Read More
NetScan Share Enumeration Write Access Check

Jan 29, 2024 · attack.discovery attack.t1135 dist.public ·
Share on:

Detects the creation of unique artifacts created by SoftPerfect NetScan when performing write-access checking on enumerated network shares

Read More