attack.t1615

Gpresult Display Group Policy Information

Aug 12, 2024 · attack.discovery attack.t1615 ·

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

HackTool - SharpUp PrivEsc Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·

Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Suspicious GPO Discovery With Get-GPO

Aug 12, 2024 · attack.discovery attack.t1615 ·

Share on:

Detect use of Get-GPO to get one GPO or all the GPOs in a domain.

Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine