attack.t1212

GALLIUM IOCs

Nov 25, 2024 · attack.credential-access attack.command-and-control attack.t1212 attack.t1071 attack.g0093 detection.emerging-threats ·

Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Guacamole Two Users Sharing Session Anomaly

Aug 12, 2024 · attack.credential-access attack.t1212 ·

Share on:

Detects suspicious session with two users present

Kerberos Manipulation

Aug 12, 2024 · attack.credential-access attack.t1212 ·

Share on:

Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

Suspicious NTLM Authentication on the Printer Spooler Service

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1212 ·

Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service