attack.t1587.001

Potential Privilege Escalation To LOCAL SYSTEM

Oct 23, 2023 · attack.resource_development attack.t1587.001 ·

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Formbook Process Creation

Oct 18, 2023 · attack.resource_development attack.t1587.001 detection.emerging_threats ·

Share on:

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Mustang Panda Dropper

Oct 18, 2023 · attack.t1587.001 attack.resource_development detection.emerging_threats ·

Share on:

Detects specific process parameters as used by Mustang Panda droppers

Uncommon File Created In Office Startup Folder

Oct 18, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects the creation of a file with an uncommon extension in an Office application startup folder

Conti Volume Shadow Listing

Jun 20, 2023 · attack.t1587.001 attack.resource_development detection.emerging_threats ·

Share on:

Detects a command used by conti to find volume shadow backups

VHD Image Download Via Browser

May 5, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.

PsExec/PAExec Escalation to LOCAL SYSTEM

Feb 28, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

Potential PsExec Remote Execution

Feb 28, 2023 · attack.resource_development attack.t1587.001 ·

Share on:

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

PUA - CsExec Execution

Feb 21, 2023 · attack.resource_development attack.t1587.001 attack.execution attack.t1569.002 ·

Share on:

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

ProxyLogon MSExchange OabVirtualDirectory

Feb 1, 2023 · attack.t1587.001 attack.resource_development ·

Share on:

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory