attack.t1203 | Detection.FYI

CVE-2021-26858 Exchange Exploitation

Oct 26, 2023 · attack.t1203 attack.execution cve.2021.26858 detection.emerging_threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

Read More
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Oct 26, 2023 · attack.credential_access attack.t1566 attack.t1203 cve.2021.33771 cve.2021.31979 detection.emerging_threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Oct 18, 2023 · detection.emerging_threats attack.execution attack.t1203 cve.2023.38331 ·
Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Read More
OMIGOD HTTP No Authentication RCE

Oct 18, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.lateral_movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
Potentially Suspicious Child Process Of WinRAR.EXE

Oct 18, 2023 · attack.execution attack.t1203 ·
Share on:

Detects potentially suspicious child processes of WinRAR.exe.

Read More
Audit CVE Event

Oct 17, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
Equation Editor Network Connection

Oct 17, 2023 · attack.execution attack.t1203 ·
Share on:

Detects network connections from Equation Editor

Read More
Excel Network Connections

Oct 17, 2023 · attack.execution attack.t1203 ·
Share on:

Detects an Excel process that opens suspicious network connections to non-private IP addresses, and attempts to cover CVE-2021-42292. You will likely have to tune this rule for your organization, but it is certainly something you should look for and could have applications for malicious activity beyond CVE-2021-42292.

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Read More
CVE-2021-31979 CVE-2021-33771 Exploits

Aug 17, 2023 · attack.credential_access attack.t1566 attack.t1203 cve.2021.33771 cve.2021.31979 detection.emerging_threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
Droppers Exploiting CVE-2017-11882

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.11882 detection.emerging_threats ·
Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Read More
Exploit for CVE-2017-0261

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.0261 detection.emerging_threats ·
Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Read More
Exploit for CVE-2017-8759

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.8759 detection.emerging_threats ·
Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Read More
Potential CVE-2021-26857 Exploitation Attempt

Jun 20, 2023 · attack.t1203 attack.execution cve.2021.26857 detection.emerging_threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

Read More
Dfsvc.EXE Network Connection To Uncommon Ports

Jun 12, 2023 · attack.execution attack.t1203 ·
Share on:

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to uncommon ports

Read More
Download From Suspicious TLD - Blacklist

May 18, 2023 · attack.initial_access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects download of certain file types from hosts in suspicious TLDs

Read More
Download From Suspicious TLD - Whitelist

May 18, 2023 · attack.initial_access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects executable downloads from suspicious remote systems

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Suspicious Browser Child Process - MacOS

Apr 5, 2023 · attack.initial_access attack.execution attack.t1189 attack.t1203 attack.t1059 ·
Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Read More
Java Running with Remote Debugging

Mar 5, 2023 · attack.t1203 attack.execution ·
Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Read More
Antivirus Exploitation Framework Detection

Feb 1, 2023 · attack.execution attack.t1203 attack.command_and_control attack.t1219 ·
Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework

Read More
iOS Implant URL Pattern

Feb 1, 2023 · attack.execution attack.t1203 attack.collection attack.t1005 attack.t1119 attack.credential_access attack.t1528 attack.t1552.001 ·
Share on:

Detects URL pattern used by iOS Implant

Read More
Suspicious HWP Sub Processes

Feb 1, 2023 · attack.initial_access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·
Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Read More