attack.t1546

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

SOURGUM Actor Behaviours

Aug 12, 2024 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege-escalation detection.emerging-threats ·

Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Suspicious Get-Variable.exe Creation

Aug 12, 2024 · attack.persistence attack.t1546 attack.defense-evasion attack.t1027 ·

Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Suspicious Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.

AppInit DLL Installation

Mar 26, 2024 · attack.privilege_escalation attack.persistence attack.t1546 attack.t1546.010 ·

Share on:

One persistence mechanism used by some variations of SmashJacker was an AppInit DLL. It would use a reg.exe command to create appropriate Windows Registry keys for persistence. Part of the RedCanary 2024 Threat Detection Report.

Non-Microsoft App Package Installation Process

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·

Share on:

Detects app package installation processes where the app is not a Microsoft app based on the publisher ID. Part of the RedCanary 2024 Threat Detection Report.

Package Support Framework (PSF) Advanced Installer Processes

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·

Share on:

Detects app package installation processes where legitimate software is included in an MSIX package, but a malicious PowerShell script may execute beforehand by employing the Package Support Framework (PSF). In these cases, the MSIX package includes the malicious script, which is executed as specified in an included config.json file. Part of the RedCanary 2024 Threat Detection Report.