attack.t1136 | Detection.FYI

AWS ElastiCache Security Group Created

Aug 12, 2024 · attack.persistence attack.t1136 attack.t1136.003 ·
Share on:

Detects when an ElastiCache security group has been created.

Read More
ESXi Account Creation Via ESXCLI

Aug 12, 2024 · attack.persistence attack.t1136 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
New Kubernetes Service Account Created

Aug 12, 2024 · attack.t1136 ·
Share on:

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

Read More
NIM Pass The Hash Tooling Detection

Oct 30, 2023 · attack.t1136 ·
Share on:

Detection of NIM Tooling that Creates a Remote User (pth_createusers.exe) and Adds them to Local Admins group (pth_addadmin.exe)

Read More
Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·
Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Read More
Default Account Usage

Jan 8, 2023 · attack.t1136 attack.t1136.001 ·
Share on:

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.

Read More