attack.t1615 | Detection.FYI

Gpresult Display Group Policy Information
Feb 21, 2023 · attack.discovery attack.t1615 ·
Share on:
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Read More
HackTool - SharpUp PrivEsc Tool Execution
Feb 13, 2023 · attack.privilege_escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:
Detects the use of SharpUp, a tool for local privilege escalation

Read More
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
Feb 8, 2023 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
Feb 8, 2023 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·
Share on:
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Read More
Suspicious GPO Discovery With Get-GPO
Jan 4, 2023 · attack.discovery attack.t1615 ·
Share on:
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.

Read More