attack.t1136

NIM Pass The Hash Tooling Detection

Oct 30, 2023 · attack.t1136 ·

Detection of NIM Tooling that Creates a Remote User (pth_createusers.exe) and Adds them to Local Admins group (pth_addadmin.exe)

AWS ElastiCache Security Group Created

Oct 12, 2023 · attack.persistence attack.t1136 attack.t1136.003 ·

Share on:

Detects when an ElastiCache security group has been created.

ESXi Account Creation Via ESXCLI

Sep 6, 2023 · attack.persistence attack.t1136 ·

Share on:

Detects user account creation on ESXi system via esxcli

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Default Account Usage

Jan 8, 2023 · attack.t1136 attack.t1136.001 ·

Share on:

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.