attack.t1553

Renamed BOINC Client Execution

Aug 12, 2024 · attack.defense-evasion attack.t1553 ·

Detects the execution of a renamed BOINC binary.

Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Suspicious RazerInstaller Explorer Subprocess

Aug 12, 2024 · attack.privilege-escalation attack.t1553 detection.emerging-threats ·

Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

CMD Launching Batch Script Stored on External Drive (Chromeloader)

Nov 9, 2022 · attack.defense_evasion attack.t1553 attack.t1553.005 ·

Share on:

Detects instances of CMD executing a batch stored on an externally-mounted drives, in turn spawning a tar extraction process.