attack.t1584

Program Executions in Suspicious Folders

Aug 12, 2024 · attack.t1587 attack.t1584 attack.resource-development ·

Detects program executions in suspicious non-program folders related to malware or hacking activity

Suspicious External WebDAV Execution

Aug 12, 2024 · attack.initial-access attack.t1584 attack.t1566 ·

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Windows Update Error

Aug 12, 2024 · attack.impact attack.resource-development attack.t1584 ·

Share on:

Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.

Search-ms and WebDAV Indicators in URL

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects URL pattern used by search(-ms)/WebDAV initial access campaign.

WebDAV Temporary Local File Creation

Aug 5, 2023 · attack.initial_access attack.t1584 attack.t1566 ·

Share on:

Detects the creation of WebDAV temporary files with suspicious extensions