attack.t1562

IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·
Share on:

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Read More
Diamond Sleet APT Scheduled Task Creation - Registry

Sep 2, 2024 · attack.defense-evasion attack.t1562 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
AWS SecurityHub Findings Evasion

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the modification of the findings on SecurityHub.

Read More
Azure Kubernetes Events Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Read More
ETW Logging Disabled For rpcrt4.dll

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Read More
ETW Logging Disabled For SCM

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

Read More
ETW Logging Disabled In .NET Processes - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Logging Tamper In .NET Processes Via CommandLine

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
Filter Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detect filter driver unloading activity via fltmc.exe

Read More
Google Cloud Firewall Modified or Deleted

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Read More
HackTool - EDRSilencer Execution

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

Read More
HackTool - EDRSilencer Execution - Filter Added

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

Read More
Hide Schedule Task Via Index Value Tamper

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Read More
Potential Suspicious Activity Using SeCEdit

Aug 12, 2024 · attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Removal Of Index Value to Hide Schedule Task - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Read More
Removal Of SD Value to Hide Schedule Task - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

Read More
Sysmon Application Crashed

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects application popup reporting a failure of the Sysmon service

Read More
Sysmon Driver Unloaded Via Fltmc.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Read More
Terminate Linux Process Via Kill

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.

Read More
Windows Defender Exclusions Added - PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 attack.execution attack.t1059 ·
Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Read More
Windows Filtering Platform Blocked Connection From EDR Agent Binary

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Read More
Windows Firewall Disabled via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects attempts to disable the Windows Firewall using PowerShell

Read More
Write Protect For Storage Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562 ·
Share on:

Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.

Read More
Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Powershell MS Defender Tampering - ScriptBlockLogging

Jan 12, 2023 · attack.defense_evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects powershell scripts attempting to disable MS Defender components using Set-MpPreference as performed by Vice Society ransomware gang. This includes additional techniques to evade existing rules by feeding in a proxy value of $true using a powershell boolean expression like (0 -eq $false).

Read More
Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·
Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Read More
Tampering of Windows Defender with Reg

Nov 29, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 ·
Share on:

Detects use of the reg utility to tamper with MS Defender protections.

Read More
Abusing PowerShell to Disable Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·
Share on:

Looks for instances of powershell being used to disable or impair Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Abusing PowerShell to Modify Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·
Share on:

Looks for instances of powershell being used to modify or degrade Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Read More