attack.t1204.001 | Detection.FYI

Symlink Etc Passwd
Feb 1, 2023 · attack.t1204.001 attack.execution ·
Share on:
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Read More
Suspicious Execution via macOS Script Editor
Dec 29, 2022 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·
Share on:
Detects when the macOS Script Editor utility spawns an unusual child process.

Read More