attack.t1564

Parent in Public Folder Suspicious Process

Aug 28, 2023 · attack.defense_evasion attack.execution attack.t1564 attack.t1059 ·

This rule detects suspicious processes with parent images located in the C:\Users\Public folder

PUA - Process Hacker Execution

Aug 28, 2023 · attack.defense_evasion attack.discovery attack.persistence attack.privilege_escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors regularly abuse it to manipulate system processes.

PUA - System Informer Execution

Aug 28, 2023 · attack.persistence attack.privilege_escalation attack.discovery attack.defense_evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

CrashControl CrashDump Disabled

Aug 17, 2023 · attack.t1564 attack.t1112 ·

Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Detect Virtualbox Driver Installation OR Starting Of VMs

Mar 5, 2023 · attack.defense_evasion attack.t1564.006 attack.t1564 ·

Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Mount Execution With Hidepid Parameter

Jan 31, 2023 · attack.credential_access attack.t1564 ·

Share on:

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Suspicious Creation with Colorcpl

Jan 6, 2023 · attack.defense_evasion attack.t1564 ·

Share on:

Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\

ISO, VHD, LNK or IMG File Extracted from Zip (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 attack.t1564 ·

Share on:

Detects extraction of ISO, VHD, LNK, or IMG files from zip files. Commonly associated with QakBot and IcedID.

Suspicious Process Execution in PerfLogs Directory

Dec 6, 2022 · attack.defense_evasion attack.t1564 ·

Share on:

Detects process execution in PerfLogs folder - a folder used by Windows for log collection - and matching previously-observed naming patterns for ransomware executables.

Suspicious Executable File Creation

Oct 26, 2022 · attack.defense_evasion attack.t1564 ·

Share on:

Detect creation of suspicious executable file name. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.

Sysmon Configuration Error

Oct 25, 2022 · attack.defense_evasion attack.t1564 ·

Share on:

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages