attack.t1562

Potential Suspicious Activity Using SeCEdit

Nov 2, 2023 · attack.discovery attack.persistence attack.defense_evasion attack.credential_access attack.privilege_escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·

Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Diamond Sleet APT Scheduled Task Creation - Registry

Oct 28, 2023 · attack.defense_evasion attack.t1562 detection.emerging_threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Terminate Linux Process Via Kill

Oct 18, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.

Windows Firewall Disabled via PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects attempts to disable the Windows Firewall using PowerShell

Azure Kubernetes Events Deleted

Oct 17, 2023 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Sysmon Crash

Oct 17, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects application popup reporting a failure of the Sysmon service

Windows Defender Exclusions Added - PowerShell

Oct 17, 2023 · attack.defense_evasion attack.t1562 attack.execution attack.t1059 ·

Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Write Protect For Storage Disabled

Oct 17, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Looks for changes to registry to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.

AWS SecurityHub Findings Evasion

Oct 12, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects the modification of the findings on SecurityHub.

Google Cloud Firewall Modified or Deleted

Oct 12, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

ETW Logging Disabled For rpcrt4.dll

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

ETW Logging Disabled For SCM

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Hide Schedule Task Via Index Value Tamper

Aug 17, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Filter Driver Unloaded Via Fltmc.EXE

Mar 14, 2023 · attack.defense_evasion attack.t1070 attack.t1562 attack.t1562.002 ·

Share on:

Detect filter driver unloading activity via fltmc.exe

ETW Logging Tamper In .NET Processes

Feb 21, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects changes to environment variables related to ETW logging. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

Sysmon Driver Unloaded Via Fltmc.EXE

Feb 16, 2023 · attack.defense_evasion attack.t1070 attack.t1562 attack.t1562.002 ·

Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Removal Of Index Value to Hide Schedule Task - Registry

Feb 9, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Removal Of SD Value to Hide Schedule Task - Registry

Feb 9, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Powershell MS Defender Tampering - ScriptBlockLogging

Jan 12, 2023 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects powershell scripts attempting to disable MS Defender components using Set-MpPreference as performed by Vice Society ransomware gang. This includes additional techniques to evade existing rules by feeding in a proxy value of $true using a powershell boolean expression like (0 -eq $false).

ETW Logging Disabled In .NET Processes - Registry

Dec 20, 2022 · attack.defense_evasion attack.t1112 attack.t1562 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Tampering of Windows Defender with Reg

Nov 29, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects use of the reg utility to tamper with MS Defender protections.

Abusing PowerShell to Disable Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·

Share on:

Looks for instances of powershell being used to disable or impair Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Abusing PowerShell to Modify Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·

Share on:

Looks for instances of powershell being used to modify or degrade Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.