attack.t1217

Automated Collection Bookmarks Using Get-ChildItem PowerShell

Aug 12, 2024 · attack.discovery attack.t1217 ·

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

File And SubFolder Enumeration Via Dir Command

Aug 12, 2024 · attack.discovery attack.t1217 ·

Share on:

Detects usage of the "dir" command part of Widows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

Suspicious Where Execution

Aug 12, 2024 · attack.discovery attack.t1217 ·

Share on:

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.