attack.t1569

Possible CVE-2021-1675 Print Spooler Exploitation

Sep 13, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Cicada Ransomware PSExec File Creation

Sep 9, 2024 · attack.lateral-movement attack.execution attack.t1570 attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects creation of a lightly-renamed PSExec file in C:\Users\Public, as observed in the Cicada3301 Ransomware report from MorphiSec.

Cicada3301 Ransomware Execution via PSExec

Sep 9, 2024 · attack.execution attack.t1569 attack.t1569.002 attack.s0029 ·

Share on:

Detects the use of a potentially-renamed psexec to run the Cicada3301 ransomware tool.

CVE-2021-1675 Print Spooler Exploitation

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·

Share on:

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

CVE-2021-1675 Print Spooler Exploitation IPC Access

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·

Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Psexec Execution

Aug 12, 2024 · attack.execution attack.t1569 attack.t1021 ·

Share on:

Detects user accept agreement execution in psexec commandline

Service Control Manager Spawning Command Shell with Suspect Strings

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.003 attack.t1569 attack.t1569.002 ·

Share on:

The following pseudo detector should generate an alert when services.exe spawns cmd.exe along with a corresponding echo or /c command, which are common attributes of post exploitation that we’ve seen in association with this technique. Part of the RedCanary 2024 Threat Detection Report.

SMBexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 attack.lateral_movement attack.t1021 attack.t1021.003 ·

Share on:

Similar to the wmiexec.py detector logic, this detection analytic is looking for services.exe spawning cmd.exe with a command line that has the following strings: '/Q', '/c', 'echo',' > ', ' 2>&1'. These strings are unique to the execution of smbexec.py, which allows a semi-interactive shell used through SMB. This script functions similar to psexec.py, but does not write a service binary to disk on the target machine. Part of the RedCanary 2024 Threat Detection Report.

Suspicious Impacket Pipe Creation - Psexec

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·

Share on:

Detects named pipes created as a result of Impacket PSExec.py usage.

Suspicious Impacket PSExec Temp Executable File Creation

Apr 16, 2023 · attack.s0357 attack.execution attack.t1569 attack.t1569.002 ·

Share on:

Detects PSExec.py (Impacket) suspicious .exe file creation in Windows directory.