attack.t1546

MSSQL Extended Stored Procedure Backdoor Maggie
Apr 14, 2023 · attack.persistence attack.t1546 ·
Share on:
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Read More
Outlook Macro Execution Without Warning Setting Enabled
Feb 9, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:
Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
Feb 9, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
New Outlook Macro Created
Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:
Detects the creation of a macro file for Outlook.

Read More
Suspicious Outlook Macro Created
Feb 8, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:
Detects the creation of a macro file for Outlook.

Read More
Control Panel Items
Jan 10, 2023 · attack.execution attack.defense_evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:
Detects the malicious use of a control panel item

Read More
Suspicious Get-WmiObject
Jan 4, 2023 · attack.persistence attack.t1546 ·
Share on:
The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers

Read More
COM Hijack via Sdclt
Oct 26, 2022 · attack.privilege_escalation attack.t1546 attack.t1548 ·
Share on:
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
Suspicious Get-Variable.exe Creation
Oct 26, 2022 · attack.persistence attack.t1546 attack.defense_evasion attack.t1027 ·
Share on:
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Read More