attack.t1203

Antivirus Exploitation Framework Detection

Aug 12, 2024 · attack.execution attack.t1203 attack.command-and-control attack.t1219 ·

Detects a highly relevant Antivirus alert that reports an exploitation framework.

Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

CVE-2021-26858 Exchange Exploitation

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26858 detection.emerging-threats ·

Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

CVE-2021-31979 CVE-2021-33771 Exploits

Aug 12, 2024 · attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·

Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Aug 12, 2024 · attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·

Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Aug 12, 2024 · detection.emerging-threats attack.execution attack.t1203 cve.2023-38331 ·

Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Download From Suspicious TLD - Blacklist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects download of certain file types from hosts in suspicious TLDs

Download From Suspicious TLD - Whitelist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects executable downloads from suspicious remote systems

Droppers Exploiting CVE-2017-11882

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-11882 detection.emerging-threats ·

Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Exploit for CVE-2017-0261

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-0261 detection.emerging-threats ·

Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Exploit for CVE-2017-8759

Aug 12, 2024 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-8759 detection.emerging-threats ·

Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Java Running with Remote Debugging

Aug 12, 2024 · attack.t1203 attack.execution ·

Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Network Connection Initiated By Eqnedt32.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·

Share on:

Detects network connections from the Equation Editor process "eqnedt32.exe".

Office Application Initiated Network Connection To Non-Local IP

Aug 12, 2024 · attack.execution attack.t1203 ·

Share on:

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

OMIGOD HTTP No Authentication RCE

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·

Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

OMIGOD SCX RunAsProvider ExecuteScript

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Potential CVE-2021-26857 Exploitation Attempt

Aug 12, 2024 · attack.t1203 attack.execution cve.2021-26857 detection.emerging-threats ·

Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

Potentially Suspicious Child Process of KeyScrambler.exe

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.002 ·

Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Potentially Suspicious Child Process Of WinRAR.EXE

Aug 12, 2024 · attack.execution attack.t1203 ·

Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Suspicious Browser Child Process - MacOS

Aug 12, 2024 · attack.initial-access attack.execution attack.t1189 attack.t1203 attack.t1059 ·

Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·

Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.