attack.t1587 | Detection.FYI

Linux HackTool Execution

Sep 22, 2024 · attack.execution attack.resource-development attack.t1587 ·
Share on:

Detects known hacktool execution based on image name.

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
FoggyWeb Backdoor DLL Loading

Aug 12, 2024 · attack.resource-development attack.t1587 detection.emerging-threats ·
Share on:

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

Read More
HackTool - PurpleSharp Execution

Aug 12, 2024 · attack.t1587 attack.resource-development ·
Share on:

Detects the execution of the PurpleSharp adversary simulation tool

Read More
Program Executions in Suspicious Folders

Aug 12, 2024 · attack.t1587 attack.t1584 attack.resource-development ·
Share on:

Detects program executions in suspicious non-program folders related to malware or hacking activity

Read More
Suspicious Word Cab File Write CVE-2021-40444

Aug 12, 2024 · attack.resource-development attack.t1587 detection.emerging-threats ·
Share on:

Detects file creation patterns noticeable during the exploitation of CVE-2021-40444

Read More