attack.t1189

Cross Site Scripting Strings

Aug 12, 2024 · attack.initial-access attack.t1189 ·

Detects XSS attempts injected via GET requests in access logs

Flash Player Update from Suspicious Location

Aug 12, 2024 · attack.initial-access attack.t1189 attack.execution attack.t1204.002 attack.defense-evasion attack.t1036.005 ·

Share on:

Detects a flashplayer update from an unofficial location

Suspicious Browser Child Process - MacOS

Aug 12, 2024 · attack.initial-access attack.execution attack.t1189 attack.t1203 attack.t1059 ·

Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

WScript Spawned from a Browser Making External Network Connections

Mar 26, 2024 · attack.initial_access attack.t1189 ·

Share on:

While JavaScript is everywhere on the web, it is rather unusual for the browser to download a JavaScript file and execute it via the Windows Script Host (wscript.exe). When this downloaded script starts communicating with devices outside of your network, things get even more suspicious. That said, this detection analytic may be noisy in some environments, so be prepared to identify what scripts are normally run in this way to tune out the noise. Part of the RedCanary 2024 Threat Detection Report.

Possible DNS Rebinding

Apr 21, 2023 · attack.initial_access attack.t1189 ·

Share on:

Detects several different DNS-answers by one domain with IPs from internal and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved in host cache for a while TTL).