attack.t1216 | Detection.FYI

Uncommon Sigverif.EXE Child Process

Aug 29, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.

Read More
Assembly Loading Via CL_LoadAssembly.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Read More
Execute Code with Pester.bat

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Execute Code with Pester.bat as Parent

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1216 ·
Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Read More
Potential Manage-bde.wsf Abuse To Proxy Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution

Read More
Potential Process Execution Proxy Via CL_Invocation.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Read More
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Read More
Remote Code Execute via Winrm.vbs

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects an attempt to execute code or create service on remote host via winrm.vbs.

Read More
Suspicious CustomShellHost Execution

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the execution of CustomShellHost binary where the child isn't located in 'C:\Windows\explorer.exe'

Read More
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1216 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs

Read More
UtilityFunctions.ps1 Proxy Dll

Aug 12, 2024 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.

Read More
Execution via CL_Invocation.ps1 (2 Lines)

Apr 21, 2023 · attack.defense_evasion attack.t1216 ·
Share on:

Detects Execution via SyncInvoke in CL_Invocation.ps1 module

Read More
Execution via CL_Mutexverifiers.ps1 (2 Lines)

Apr 21, 2023 · attack.defense_evasion attack.t1216 ·
Share on:

Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module

Read More