attack.t1553.005

Suspicious Invoke-Item From Mount-DiskImage

Aug 12, 2024 · attack.defense-evasion attack.t1553.005 ·

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Suspicious Mount-DiskImage

Aug 12, 2024 · attack.defense-evasion attack.t1553.005 ·

Share on:

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Suspicious Unblock-File

Aug 12, 2024 · attack.defense-evasion attack.t1553.005 ·

Share on:

Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.

ISO File Write to Suspicious Folder (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1553.005 ·

Share on:

Detects files written to user downloads folder or appdata folder, associated with Mark-of-the-Web Bypass. Part of the RedCanary 2023 Threat Detection Report.

CMD Launching Batch Script Stored on External Drive (Chromeloader)

Nov 9, 2022 · attack.defense_evasion attack.t1553 attack.t1553.005 ·

Share on:

Detects instances of CMD executing a batch stored on an externally-mounted drives, in turn spawning a tar extraction process.