-
Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory.
Read More -
Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets.
Read More -
Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
Read More -
Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.
Read More -
Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
Read More -
Identifies attempts to open a Microsoft Management Console File from untrusted paths. Adversaries may use MSC files for initial access and execution.
Read More -
The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.
Read More -
Potential Remote Desktop Tunneling Detected
Aug 9, 2024 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Resources: Investigation Guide Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: SentinelOne Data Source: Microsoft Defender for Endpoint Data Source: System ·Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Read More -
Identifies a potential Windows Server Update Services (WSUS) abuse to execute psexec to enable for lateral movement. WSUS is limited to executing Microsoft signed binaries, which limits the executables that can be used to tools published by Microsoft.
Read More -
Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders.
Read More -
Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities.
Read More -
Suspicious MS Outlook Child Process
Aug 9, 2024 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Tactic: Defense Evasion Tactic: Execution Resources: Investigation Guide Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: SentinelOne Data Source: Microsoft Defender for Endpoint Data Source: System ·Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.
Read More -
Suspicious ScreenConnect Client Child Process
Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software.
Read More -
Suspicious Zoom Child Process
A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well.
Read More -
Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.
Read More -
Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.
Read More -
Identifies DACL modifications to deny access to a service, making it unstoppable, or hide it from system and users.
Read More -
Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes.
Read More -
Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation.
Read More -
Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.
Read More -
Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code.
Read More -
Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.
Read More