attack.t1482

Malicious PowerShell Commandlets - PoshModule

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ProcessCreation

Mar 4, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Renamed AdFind Execution

Nov 25, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Potential Active Directory Reconnaissance/Enumeration Via LDAP

Aug 27, 2024 · attack.discovery attack.t1069.002 attack.t1087.002 attack.t1482 ·

Share on:

Detects potential Active Directory enumeration via LDAP

BloodHound Collection Files

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

DNS Server Discovery Via LDAP Query

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects DNS server discovery via LDAP query requests from uncommon applications

Domain Trust Discovery Via Dsquery

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects execution of "dsquery.exe" for domain trust discovery

HackTool - Bloodhound/Sharphound Execution

Aug 12, 2024 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

HackTool - TruffleSnout Execution

Aug 12, 2024 · attack.discovery attack.t1482 ·

Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Malicious PowerShell Commandlets - ScriptBlock

Aug 12, 2024 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Nltest.EXE Execution

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Potential Recon Activity Via Nltest.EXE

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

PUA - AdFind Suspicious Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·

Share on:

Detects AdFind execution with common flags seen used during attacks

AdFind Discovery

Aug 2, 2024 · attack.discovery attack.t1018 attack.t1482 attack.t1069.002 attack.t1087.002 attack.s0552 ·

Share on:

AdFind has been seen in numerous intrusions. The threat actor(s) ran these commands.

Enumerating Domain Trust Relationships with Nltest.exe

Mar 26, 2024 · attack.discovery attack.t1482 ·

Share on:

Left unchecked, SocGholish may lead to domain discovery. This type of behavior is often a precursor to ransomware activity, and should be quickly quelled to prevent further progression of the threat. Part of the RedCanary 2024 Threat Detection Report.

SocGholish NLTest Domain Trust Enumeration (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1482 ·

Share on:

Detects domain trust enumeration with nltest.exe, a procedure associated with SocGholish. Part of the RedCanary 2023 Threat Detection Report.