attack.t1529 | Detection.FYI

Hyper-V Virtual Machine Discovery Shutdown via Powershell Cmdlets

Sep 9, 2024 · attack.defense-evasion attack.impact attack.t1578 attack.t1578.003 attack.t1529 ·
Share on:

Detects powershell process used to find and shut down local Hyper-V VMs using the Stop-VM cmdlet, as documented in the 2024 Morphisec report on Cicada3301 ransomware.

Read More
IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·
Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Read More
Cisco Denial of Service

Aug 12, 2024 · attack.impact attack.t1495 attack.t1529 attack.t1565.001 ·
Share on:

Detect a system being shutdown or put into different boot mode

Read More
Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
Suspicious Execution of Shutdown

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Use of the commandline to shutdown or reboot windows

Read More
Suspicious Execution of Shutdown to Log Out

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Detects the rare use of the command line tool shutdown to logoff a user

Read More
System Shutdown/Reboot - Linux

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Read More
System Shutdown/Reboot - MacOs

Aug 12, 2024 · attack.impact attack.t1529 ·
Share on:

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Read More