attack.t1574

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Potential Registry Persistence Attempt Via DbgManagedDebugger

Aug 12, 2024 · attack.persistence attack.t1574 ·

Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Regsvr32 DLL Execution With Uncommon Extension

Aug 12, 2024 · attack.defense-evasion attack.t1574 attack.execution ·

Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Suspicious Printer Driver Empty Manufacturer

Aug 12, 2024 · attack.privilege-escalation attack.t1574 cve.2021-1675 ·

Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

PowerShell Suspicious .NET Methods

Mar 26, 2024 · attack.defense_evasion attack.t1140 attack.t1574 attack.t1574.013 ·

Share on:

Detects the loading of suspicious .NET methods, seen in PowerShell script load content. This behavior is not limited to Yellow Cockatoo and can be applied universally for malicious PowerShell obfuscation attempts. Part of the RedCanary 2024 Threat Detection Report.

Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·

Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Files Dropped to Program Files by Non-Priviledged Process

Apr 21, 2023 · attack.persistence attack.defense_evasion attack.t1574 attack.t1574.010 ·

Share on:

Search for dropping of files to Windows/Program Files fodlers by non-priviledged processes