attack.t1219

Potential Amazon SSM Agent Hijacking

Oct 28, 2023 · attack.command_and_control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential Linux Amazon SSM Agent Hijacking

Oct 28, 2023 · attack.command_and_control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential SocGholish Second Stage C2 DNS Query

Oct 26, 2023 · attack.command_and_control attack.t1219 detection.emerging_threats ·

Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

DNS Query To Remote Access Software Domain From Non-Browser App

Oct 18, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

ScreenConnect Temporary Installation Artefact

Oct 18, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Inveigh Execution Artefacts

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects the presence and execution of Inveigh via dropped artefacts

Mesh Agent Service Installation

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Suspicious Binary Writes Via AnyDesk

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Suspicious TSCON Start as SYSTEM

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a tscon.exe start as LOCAL SYSTEM

TacticalRMM Service Installation

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Use of UltraViewer Remote Access Software

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Use of UltraVNC Remote Access Software

Oct 17, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

TeamViewer Domain Query By Non-TeamViewer Application

Oct 4, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Mstsc.EXE Execution With Local RDP File

Apr 30, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Suspicious Mstsc.EXE Execution With Local RDP File

Apr 30, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Atera Agent Installation

Apr 14, 2023 · attack.t1219 ·

Share on:

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

Arbitrary code execution and remote sessions via Action1 RMM

Apr 13, 2023 · attack.CommandAndControl attack.T1219 ·

Share on:

Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed. Hunting Opportunity 1- Weed Out The Noise --- When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. Below is an example of the command line that contains the deployment of a binary through a policy with name "test_app_1": ParentCommandLine: "C:\WINDOWS\Action1\action1_agent.exe schedule:Deploy_App__test_app_1_1681327673425 runaction:0"

After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences. An example query of this in Splunk could be: Index="" source="" Image="*\action1_agent.exe" ParentCommandLine="runaction:0" | rex field=ParentCommandLine "(?<=Deploy_App__)(?.(?=(_1)))"

Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours ---- If you have admins within your environment using remote sessions to administer endpoints, you can create a threat-hunting query and modify the time of the initiated sessions looking for abnormal activity.

Remote Access Tool - Anydesk Execution From Suspicious Folder

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Piped Password Via CLI

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Remote Access Tool - AnyDesk Silent Installation

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Remote Access Tool - GoToAssist Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - LogMeIn Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - NetSupport Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Backstage Mode Anomaly

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects suspicious sub processes started by the ScreenConnect client service, which indicates the use of the so-called Backstage mode

Remote Access Tool - ScreenConnect Execution

Mar 5, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Antivirus Exploitation Framework Detection

Feb 1, 2023 · attack.execution attack.t1203 attack.command_and_control attack.t1219 ·

Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework

TeamViewer Remote Session

Feb 1, 2023 · attack.command_and_control attack.t1219 ·

Share on:

Detects the creation of log files during a TeamViewer remote session

Anydesk Temporary Artefact

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

GoToAssist Temporary Installation Artefact

Jan 27, 2023 · attack.command_and_control attack.t1219 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)