attack.t1547.010 | Detection.FYI

Add Port Monitor Persistence in Registry

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Bypass UAC Using Event Viewer

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
Changing RDP Port to Non Standard Number

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Potential Suspicious Activity Using SeCEdit

Mar 5, 2023 · attack.discovery attack.persistence attack.defense_evasion attack.credential_access attack.privilege_escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More