attack.t1202

Lolbin Ssh.exe Use As Proxy

Dec 1, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs

Findstr Launching .lnk File

Nov 15, 2023 · attack.defense_evasion attack.t1036 attack.t1202 attack.t1027.003 ·

Share on:

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Potentially Suspicious Child Process Of VsCode

Oct 28, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Execute Python Scripts via Python Installer Binary

Oct 26, 2023 · attack.Defense.Evasion attack.T1202 ·

Share on:

Detects the execution of malicious Python scripts from the AppData directory after the execution of the setup.exe installation package. Some installation packages allow for post-installation scripts to be run. A malicious actor could modify these scripts or add their own to execute malicious actions after the legitimate software is installed.

Potentially Suspicious Office Document Executed From Trusted Location

Oct 23, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Indirect Command Execution From Script File Via Bash.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash

Indirect Inline Command Execution Via Bash.EXE

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash

Potential Arbitrary File Download Using Office Application

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects potential arbitrary file download using a Microsoft Office application

Renamed PAExec Execution

Oct 18, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of renamed version of PAExec. Often used by attackers

Suspicious Child Process Of BgInfo.EXE

Oct 18, 2023 · attack.execution attack.t1059.005 attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Suspicious Remote Child Process From Outlook

Oct 18, 2023 · attack.execution attack.t1059 attack.t1202 ·

Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Potential Binary Impersonating Sysinternals Tools

Oct 17, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection

Suspicious Cmdl32 Execution

Oct 17, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

lolbas Cmdl32 is use to download a payload to evade antivirus

Suspicious High IntegrityLevel Conhost Legacy Option

Oct 17, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Troubleshooting Pack Cmdlet Execution

Oct 17, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)

Use of Setres.exe

Oct 17, 2023 · attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects the use of Setres.exe to set the screen resolution and then potentially launch a file named "choice" (with any executable extension such as ".cmd" or ".exe") from the current execution path

Renamed CURL.EXE Execution

Oct 12, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Rundll32 Execution Without CommandLine Parameters

Sep 16, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Uncommon Child Process Of BgInfo.EXE

Aug 18, 2023 · attack.execution attack.t1059.005 attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Custom File Open Handler Executes PowerShell

Aug 17, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects the abuse of custom file open handler, executing powershell

WSL Child Process Anomaly

Aug 15, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL

LOLBIN Execution Of The FTP.EXE Binary

Aug 11, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of ftp.exe script execution with the "-s" or "/s" flag and any child processes ran by ftp.exe

Arbitrary Command Execution Using WSL

Jun 21, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a LOLBIN to execute arbitrary Linux or Windows commands

Uncommon Child Process Of Conhost.EXE

Jun 1, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Potential Arbitrary DLL Load Using Winword

Apr 3, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

Suspicious Splwow64 Without Params

Mar 5, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects suspicious Splwow64.exe process without any command line parameters

Suspicious Runscripthelper.exe

Mar 2, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Suspicious ZipExec Execution

Mar 2, 2023 · attack.execution attack.defense_evasion attack.t1218 attack.t1202 ·

Share on:

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.

Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Feb 20, 2023 · attack.defense_evasion attack.t1202 cve.2022.30190 ·

Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

Windows Binary Executed From WSL

Feb 16, 2023 · attack.execution attack.defense_evasion attack.t1202 ·

Share on:

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Renamed ZOHO Dctask64 Execution

Feb 13, 2023 · attack.defense_evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·

Share on:

Detects a renamed dctask64.exe used for process injection, command execution, process creation with a signed binary by ZOHO Corporation

Outlook EnableUnsafeClientMailRules Setting Enabled

Feb 9, 2023 · attack.execution attack.t1059 attack.t1202 ·

Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Potential Arbitrary Command Execution Using Msdt.EXE

Feb 8, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

Renamed FTP.EXE Execution

Feb 7, 2023 · attack.execution attack.t1059 attack.defense_evasion attack.t1202 ·

Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Suspicious Cabinet File Execution Via Msdt.EXE

Feb 7, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190

Suspicious Service Binary Directory

Feb 1, 2023 · attack.defense_evasion attack.t1202 ·

Share on:

Detects a service binary running in a suspicious directory

Solarmarker File Extension Registry Key Set

Nov 9, 2022 · attack.defense_evasion attack.t1202 ·

Share on:

Detects creation of suspicious file extension registry key. This extension is then registered with a custom file type (see Detail component of detection below) with a malicious powershell payload specified.