attack.t1546

HAFNIUM Exchange Exploitation Activity

Nov 28, 2023 · attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging_threats ·

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

MSSQL Extended Stored Procedure Backdoor Maggie

Oct 26, 2023 · attack.persistence attack.t1546 detection.emerging_threats ·

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Suspicious Get-Variable.exe Creation

Oct 17, 2023 · attack.persistence attack.t1546 attack.defense_evasion attack.t1027 ·

Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Suspicious Get-WmiObject

Oct 17, 2023 · attack.persistence attack.t1546 ·

Share on:

The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers

Control Panel Items

Oct 12, 2023 · attack.execution attack.defense_evasion attack.t1218.002 attack.persistence attack.t1546 ·

Share on:

Detects the malicious use of a control panel item

COM Hijack via Sdclt

Oct 4, 2023 · attack.privilege_escalation attack.t1546 attack.t1548 ·

Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Outlook Macro Execution Without Warning Setting Enabled

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

SOURGUM Actor Behaviours

Jun 20, 2023 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege_escalation detection.emerging_threats ·

Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

New Outlook Macro Created

Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

Suspicious Outlook Macro Created

Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.