attack.t1562

IISReset Used to Stop IIS Services

Sep 9, 2024 · attack.impact attack.defense-evasion attack.t1562 attack.t1562.001 attack.t1529 ·

Detects the use of the iisreset.exe utility to stop IIS web services. This is used to prevent users from accessing IIS web resources, thereby releasing/preventing locks which could inhibit ransomware-related encryption.

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Powershell MS Defender Tampering - ScriptBlockLogging

Jan 12, 2023 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects powershell scripts attempting to disable MS Defender components using Set-MpPreference as performed by Vice Society ransomware gang. This includes additional techniques to evade existing rules by feeding in a proxy value of $true using a powershell boolean expression like (0 -eq $false).

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Tampering of Windows Defender with Reg

Nov 29, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 ·

Share on:

Detects use of the reg utility to tamper with MS Defender protections.

Abusing PowerShell to Disable Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·

Share on:

Looks for instances of powershell being used to disable or impair Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.

Abusing PowerShell to Modify Defender Components

Nov 9, 2022 · attack.defense_evasion attack.t1562 attack.t1562.001 attack.t1562.004 ·

Share on:

Looks for instances of powershell being used to modify or degrade Windows Defender functionality. Inspired by the 2022 Red Canary Threat Detection report.