attack.t1566

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Potential Initial Access via DLL Search Order Hijacking

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·

Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Potential Malicious Usage of CloudTrail System Manager

Aug 12, 2024 · attack.privilege-escalation attack.t1566 attack.t1566.002 ·

Share on:

Detect when System Manager successfully executes commands against an instance.

Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Suspicious External WebDAV Execution

Aug 12, 2024 · attack.initial-access attack.t1584 attack.t1566 ·

Share on:

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious Microsoft OneNote Child Process

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access ·

Share on:

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Search-ms and WebDAV Indicators in URL

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaign.

WebDAV Temporary Local File Creation

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects the creation of WebDAV temporary files with suspicious extensions

Yellow Cockatoo Powershell Startup Folder Persistence (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects .lnk files created by Powershell in the startup folder. Associated with (but not unique to) Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Yellow Cockatoo PowerShell Suspicious .NET Methods (RedCanary Threat Detection Report)

May 10, 2023 · attack.initial_access attack.defense_evasion attack.t1566 ·

Share on:

Detects suspicious Powershell script load contents associated with Yellow Cockatoo, AKA Solarmarker/Jupyter Stealer. Part of the RedCanary 2023 Threat Detection Report.

Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.