attack.t1564.001

Registry Persistence via Service in Safe Mode

Oct 28, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Use Icacls to Hide File to Everyone

Oct 18, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Modification of Explorer Hidden Keys

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects modifications to the hidden files keys in registry. This technique is abused by several malware families to hide their files from normal users.

PowerShell Logging Disabled Via Registry Key Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Hiding Files with Attrib.exe

Mar 14, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects usage of attrib.exe to hide files from users.

Set Files as System Files Using Attrib.EXE

Mar 14, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects the execution of "attrib" with the "+s" flag to mark files as system files

Set Suspicious Files as System Files Using Attrib.EXE

Mar 14, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Hidden Files and Directories

Jan 10, 2023 · attack.defense_evasion attack.t1564.001 ·

Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character