attack.t1211

Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Microsoft Malware Protection Engine Crash

Aug 12, 2024 · attack.defense-evasion attack.t1211 attack.t1562.001 ·

Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Microsoft Malware Protection Engine Crash - WER

Aug 12, 2024 · attack.defense-evasion attack.t1211 attack.t1562.001 ·

Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Writing Of Malicious Files To The Fonts Folder

Aug 12, 2024 · attack.t1211 attack.t1059 attack.defense-evasion attack.persistence ·

Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.