attack.t1543

PUA - Process Hacker Driver Load

Nov 25, 2024 · attack.privilege-escalation cve.2021-21551 attack.t1543 ·

Detects driver load of the Process Hacker tool

PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

PUA - System Informer Driver Load

Nov 25, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects driver load of the System Informer tool

PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

CodeIntegrity - Blocked Driver Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects blocked load attempts of revoked drivers

CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

KrbRelayUp Service Installation

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Service Installed By Unusual Client - Security

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Service Installed By Unusual Client - System

Aug 12, 2024 · attack.privilege-escalation attack.t1543 ·

Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0