attack.t1482

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

HackTool - TruffleSnout Execution

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Malicious PowerShell Commandlets - PoshModule

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ProcessCreation

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Nltest.EXE Execution

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Potential Recon Activity Via Nltest.EXE

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

PUA - AdFind Suspicious Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·

Share on:

Detects AdFind execution with common flags seen used during attacks

Renamed AdFind Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Enumerating Domain Trust Relationships with Nltest.exe

Mar 26, 2024 · attack.discovery attack.t1482 ·

Share on:

Left unchecked, SocGholish may lead to domain discovery. This type of behavior is often a precursor to ransomware activity, and should be quickly quelled to prevent further progression of the threat. Part of the RedCanary 2024 Threat Detection Report.

AdFind Discovery

Feb 23, 2024 · attack.discovery attack.t1018 attack.t1482 attack.t1069.002 attack.t1087.002 attack.s0552 ·

Share on:

AdFind has been seen in numerous intrusions. The threat actor(s) ran these commands.

SocGholish NLTest Domain Trust Enumeration (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1482 ·

Share on:

Detects domain trust enumeration with nltest.exe, a procedure associated with SocGholish. Part of the RedCanary 2023 Threat Detection Report.