detection.emerging_threats

Suspicious Sysmon as Execution Parent

Sep 13, 2023 · attack.privilege_escalation attack.t1068 cve.2022.41120 detection.emerging_threats ·

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Sep 7, 2023 · attack.execution cve.2023.38331 detection.emerging_threats ·

Share on:

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Sep 7, 2023 · detection.emerging_threats attack.execution attack.t1203 cve.2023.38331 ·

Share on:

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

CVE-2023-40477 Potential Exploitation - .REV File Creation

Sep 7, 2023 · attack.execution cve.2023.40477 detection.emerging_threats ·

Share on:

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Sep 7, 2023 · attack.execution cve.2023.40477 detection.emerging_threats ·

Share on:

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

FoggyWeb Backdoor DLL Loading

Sep 7, 2023 · attack.resource_development attack.t1587 detection.emerging_threats ·

Share on:

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Sep 7, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

Pingback Backdoor DLL Loading Activity

Sep 7, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

Sep 7, 2023 · attack.execution cve.2023.36874 detection.emerging_threats ·

Share on:

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Sep 7, 2023 · attack.execution cve.2023.36874 detection.emerging_threats ·

Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location

Sep 7, 2023 · attack.execution cve.2023.36874 detection.emerging_threats ·

Share on:

Detects the creation of a "Report.wer" file in an uncommon folder structure. This could be a sign of potential exploitation of CVE-2023-36874.

Qakbot Uninstaller Execution

Sep 1, 2023 · detection.emerging_threats attack.execution ·

Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

ADSelfService Exploitation

Aug 28, 2023 · cve.2021.40539 detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Aug 28, 2023 · cve.2023.34362 detection.emerging_threats attack.persistence attack.t1505.003 ·

Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Potential BlackByte Ransomware Activity

Aug 28, 2023 · detection.emerging_threats attack.execution attack.defense_evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 ·

Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Aug 28, 2023 · detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

ProxyLogon Reset Virtual Directories Based On IIS Log

Aug 28, 2023 · cve.2021.26858 detection.emerging_threats attack.initial_access attack.t1190 ·

Share on:

When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

Suspicious Computer Account Name Change CVE-2021-42287

Aug 28, 2023 · cve.2021.42287 detection.emerging_threats attack.defense_evasion attack.persistence attack.t1036 attack.t1098 ·

Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Devil Bait Potential C2 Communication Traffic

Aug 23, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Devil Bait malware

Potential CVE-2023-21554 QueueJumper Exploitation

Aug 18, 2023 · attack.privilege_escalation attack.execution cve.2023.21554 detection.emerging_threats ·

Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

CVE-2021-31979 CVE-2021-33771 Exploits

Aug 17, 2023 · attack.credential_access attack.t1566 attack.t1203 cve.2021.33771 cve.2021.31979 detection.emerging_threats ·

Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Outlook Task/Note Reminder Received

Aug 17, 2023 · attack.persistence attack.t1137 cve.2023.23397 detection.emerging_threats ·

Share on:

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Potential COLDSTEEL RAT Windows User Creation

Aug 17, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Potential Encrypted Registry Blob Related To SNAKE Malware

Aug 17, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Small Sieve Malware Registry Persistence

Aug 17, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

Pingback Backdoor Activity

Aug 2, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

NotPetya Ransomware Activity

Jun 21, 2023 · attack.defense_evasion attack.t1218.011 attack.t1070.001 attack.credential_access attack.t1003.001 car.2016-04-002 detection.emerging_threats ·

Share on:

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

Adwind RAT / JRAT

Jun 20, 2023 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging_threats ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Apache Spark Shell Command Injection - Weblogs

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.33891 detection.emerging_threats ·

Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective

APT PRIVATELOG Image Load Pattern

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 detection.emerging_threats ·

Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

APT27 - Emissary Panda Activity

Jun 20, 2023 · attack.defense_evasion attack.t1574.002 attack.g0027 detection.emerging_threats ·

Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

APT29 2018 Phishing Campaign CommandLine Indicators

Jun 20, 2023 · attack.execution attack.t1218.011 detection.emerging_threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

APT29 2018 Phishing Campaign File Indicators

Jun 20, 2023 · attack.execution attack.t1218.011 detection.emerging_threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

APT31 Judgement Panda Activity

Jun 20, 2023 · attack.lateral_movement attack.credential_access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging_threats ·

Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Arcadyan Router Exploitations

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.20090 cve.2021.20091 detection.emerging_threats ·

Share on:

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Atlassian Bitbucket Command Injection Via Archive API

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.36804 detection.emerging_threats ·

Share on:

Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804

Blue Mockingbird

Jun 20, 2023 · attack.execution attack.t1112 attack.t1047 detection.emerging_threats ·

Share on:

Attempts to detect system changes made by Blue Mockingbird

Cisco ASA FTD Exploit CVE-2020-3452

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2020.3452 detection.emerging_threats ·

Share on:

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.8193 cve.2020.8195 detection.emerging_threats ·

Share on:

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Citrix Netscaler Attack CVE-2019-19781

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2019.19781 detection.emerging_threats ·

Share on:

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

COLDSTEEL Persistence Service Creation

Jun 20, 2023 · attack.defense_evasion attack.persistence detection.emerging_threats ·

Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

COLDSTEEL RAT Anonymous User Process Execution

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

COLDSTEEL RAT Cleanup Command Execution

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

COLDSTEEL RAT Service Persistence Execution

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Confluence Exploitation CVE-2019-3398

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2019.3398 detection.emerging_threats ·

Share on:

Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

Conti NTDS Exfiltration Command

Jun 20, 2023 · attack.collection attack.t1560 detection.emerging_threats ·

Share on:

Detects a command used by conti to exfiltrate NTDS

Conti Volume Shadow Listing

Jun 20, 2023 · attack.t1587.001 attack.resource_development detection.emerging_threats ·

Share on:

Detects a command used by conti to find volume shadow backups

CVE-2010-5278 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2010.5278 detection.emerging_threats ·

Share on:

MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.

CVE-2020-0688 Exchange Exploitation via Web Log

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.0688 detection.emerging_threats ·

Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

CVE-2020-0688 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.0688 detection.emerging_threats ·

Share on:

Detects CVE-2020-0688 Exploitation attempts

CVE-2020-10148 SolarWinds Orion API Auth Bypass

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.10148 detection.emerging_threats ·

Share on:

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

CVE-2020-5902 F5 BIG-IP Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2020.5902 detection.emerging_threats ·

Share on:

Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

CVE-2021-1675 Print Spooler Exploitation

Jun 20, 2023 · attack.execution attack.t1569 cve.2021.1675 detection.emerging_threats ·

Share on:

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

CVE-2021-1675 Print Spooler Exploitation IPC Access

Jun 20, 2023 · attack.execution attack.t1569 cve.2021.1675 cve.2021.34527 detection.emerging_threats ·

Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

CVE-2021-21972 VSphere Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.21972 detection.emerging_threats ·

Share on:

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

CVE-2021-21978 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.21978 detection.emerging_threats ·

Share on:

Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978

CVE-2021-33766 Exchange ProxyToken Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.33766 detection.emerging_threats ·

Share on:

Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766

CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Jun 20, 2023 · attack.initial_access attack.t1190 attack.persistence attack.t1505.003 cve.2021.40539 detection.emerging_threats ·

Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

CVE-2021-41773 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.41773 detection.emerging_threats ·

Share on:

Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

CVE-2022-31656 VMware Workspace ONE Access Auth Bypass

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.31656 detection.emerging_threats ·

Share on:

Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

CVE-2022-31659 VMware Workspace ONE Access RCE

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.31659 detection.emerging_threats ·

Share on:

Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659

CVE-2023-23397 Exploitation Attempt

Jun 20, 2023 · attack.credential_access attack.initial_access cve.2023.23397 detection.emerging_threats ·

Share on:

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

DarkSide Ransomware Pattern

Jun 20, 2023 · attack.execution attack.t1204 detection.emerging_threats ·

Share on:

Detects DarkSide Ransomware and helpers

Defrag Deactivation

Jun 20, 2023 · attack.persistence attack.t1053.005 attack.s0111 detection.emerging_threats ·

Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Defrag Deactivation - Security

Jun 20, 2023 · attack.persistence attack.t1053 attack.s0111 detection.emerging_threats ·

Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

DEWMODE Webshell Access

Jun 20, 2023 · attack.persistence attack.t1505.003 detection.emerging_threats ·

Share on:

Detects access to DEWMODE webshell as described in FIREEYE report

DNS RCE CVE-2020-1350

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1569.002 cve.2020.1350 detection.emerging_threats ·

Share on:

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

Droppers Exploiting CVE-2017-11882

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.11882 detection.emerging_threats ·

Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Elise Backdoor Activity

Jun 20, 2023 · attack.g0030 attack.g0050 attack.s0081 attack.execution attack.t1059.003 detection.emerging_threats ·

Share on:

Detects Elise backdoor activity used by APT32

Equation Group DLL_U Export Function Load

Jun 20, 2023 · attack.g0020 attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects a specific export function name used by one of EquationGroup tools

EvilNum APT Golden Chickens Deployment Via OCX Files

Jun 20, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Exchange Exploitation CVE-2021-28480

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.28480 detection.emerging_threats ·

Share on:

Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480

Exchange Exploitation Used by HAFNIUM

Jun 20, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Exploit for CVE-2015-1641

Jun 20, 2023 · attack.defense_evasion attack.t1036.005 cve.2015.1641 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

Exploit for CVE-2017-0261

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.0261 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Exploit for CVE-2017-8759

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.8759 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Exploitation of CVE-2021-26814 in Wazuh

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.21978 cve.2021.26814 detection.emerging_threats ·

Share on:

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

Exploited CVE-2020-10189 Zoho ManageEngine

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020.10189 detection.emerging_threats ·

Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Exploiting CVE-2019-1388

Jun 20, 2023 · attack.privilege_escalation attack.t1068 cve.2019.1388 detection.emerging_threats ·

Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Exploiting SetupComplete.cmd CVE-2019-1378

Jun 20, 2023 · attack.privilege_escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019.1378 detection.emerging_threats ·

Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Fireball Archer Install

Jun 20, 2023 · attack.execution attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects Archer malware invocation via rundll32

Formbook Process Creation

Jun 20, 2023 · attack.resource_development attack.t1587.001 detection.emerging_threats ·

Share on:

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Fortinet CVE-2018-13379 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2018.13379 detection.emerging_threats ·

Share on:

Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

Fortinet CVE-2021-22123 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.22123 detection.emerging_threats ·

Share on:

Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

GALLIUM IOCs

Jun 20, 2023 · attack.credential_access attack.command_and_control attack.t1212 attack.t1071 attack.g0093 detection.emerging_threats ·

Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Goofy Guineapig Backdoor IOC

Jun 20, 2023 · attack.execution attack.defense_evasion detection.emerging_threats ·

Share on:

Detects malicious indicators seen used by the Goofy Guineapig malware

Goofy Guineapig Backdoor Potential C2 Communication

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Goofy Guineapig backdoor

Goofy Guineapig Backdoor Service Creation

Jun 20, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects service creation persistence used by the Goofy Guineapig backdoor

Grafana Path Traversal Exploitation CVE-2021-43798

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.43798 detection.emerging_threats ·

Share on:

Detects a successful Grafana path traversal exploitation

Greenbug Espionage Group Indicators

Jun 20, 2023 · attack.g0049 attack.execution attack.t1059.001 attack.command_and_control attack.t1105 attack.defense_evasion attack.t1036.005 detection.emerging_threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Griffon Malware Attack Pattern

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects process execution patterns related to Griffon malware as reported by Kaspersky

HAFNIUM Exchange Exploitation Activity

Jun 20, 2023 · attack.persistence attack.t1546 attack.t1053 detection.emerging_threats ·

Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Hermetic Wiper TG Process Patterns

Jun 20, 2023 · attack.execution attack.lateral_movement attack.t1021.001 detection.emerging_threats ·

Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Lazarus Group Activity

Jun 20, 2023 · attack.g0032 attack.execution attack.t1059 detection.emerging_threats ·

Share on:

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Lazarus System Binary Masquerading

Jun 20, 2023 · attack.defense_evasion attack.t1036.005 detection.emerging_threats ·

Share on:

Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

LockerGoga Ransomware Activity

Jun 20, 2023 · attack.impact attack.t1486 detection.emerging_threats ·

Share on:

Detects LockerGoga ransomware activity via specific command line.

Log4j RCE CVE-2021-44228 Generic

Jun 20, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Log4j RCE CVE-2021-44228 in Fields

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.44228 detection.emerging_threats ·

Share on:

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Malicious DLL Load By Compromised 3CXDesktopApp

Jun 20, 2023 · attack.defense_evasion detection.emerging_threats ·

Share on:

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

MERCURY APT Activity

Jun 20, 2023 · attack.execution attack.t1059.001 attack.g0069 detection.emerging_threats ·

Share on:

Detects suspicious command line patterns seen being used by MERCURY APT

Mint Sandstorm - AsperaFaspex Suspicious Process Execution

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Mint Sandstorm - Log4J Wstomcat Process Execution

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

Mint Sandstorm - ManageEngine Suspicious Process Execution

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Moriya Rootkit File Created

Jun 20, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 detection.emerging_threats ·

Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Mustang Panda Dropper

Jun 20, 2023 · attack.t1587.001 attack.resource_development detection.emerging_threats ·

Share on:

Detects specific process parameters as used by Mustang Panda droppers

OilRig APT Activity

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·

Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

OilRig APT Schedule Task Persistence - Security

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·

Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

OilRig APT Schedule Task Persistence - System

Jun 20, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 detection.emerging_threats ·

Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Operation Wocao Activity

Jun 20, 2023 · attack.discovery attack.t1012 attack.defense_evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects activity mentioned in Operation Wocao report

Operation Wocao Activity - Security

Jun 20, 2023 · attack.discovery attack.t1012 attack.defense_evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects activity mentioned in Operation Wocao report

Oracle WebLogic Exploit

Jun 20, 2023 · attack.t1190 attack.initial_access attack.persistence attack.t1505.003 cve.2018.2894 detection.emerging_threats ·

Share on:

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Oracle WebLogic Exploit CVE-2020-14882

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2020.14882 detection.emerging_threats ·

Share on:

Detects exploitation attempts on WebLogic servers

Oracle WebLogic Exploit CVE-2021-2109

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2021.2109 detection.emerging_threats ·

Share on:

Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109

OWASSRF Exploitation Attempt Using Public POC - Webserver

Jun 20, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

PaperCut MF/NG Exploitation Related Indicators

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects exploitation indicators related to PaperCut MF/NG Exploitation

PaperCut MF/NG Potential Exploitation

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

Pingback Backdoor File Indicators

Jun 20, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Possible CVE-2021-1675 Print Spooler Exploitation

Jun 20, 2023 · attack.execution attack.t1569 cve.2021.1675 detection.emerging_threats ·

Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Potential ACTINIUM Persistence Activity

Jun 20, 2023 · attack.persistence attack.t1053 attack.t1053.005 detection.emerging_threats ·

Share on:

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Potential APT FIN7 POWERHOLD Execution

Jun 20, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

Potential APT FIN7 Related PowerShell Script Created

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

Potential APT Mustang Panda Activity Against Australian Gov

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32

Jun 20, 2023 · attack.defense_evasion attack.t1218.010 detection.emerging_threats ·

Share on:

Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local

Potential APT10 Cloud Hopper Activity

Jun 20, 2023 · attack.execution attack.g0045 attack.t1059.005 detection.emerging_threats ·

Share on:

Detects potential process and execution activity related to APT10 Cloud Hopper operation

Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2021.26084 detection.emerging_threats ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Potential Baby Shark Malware Activity

Jun 20, 2023 · attack.execution attack.defense_evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging_threats ·

Share on:

Detects activity that could be related to Baby Shark malware

Potential BearLPE Exploitation

Jun 20, 2023 · attack.privilege_escalation attack.t1053.005 car.2013-08-001 detection.emerging_threats ·

Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Potential Bumblebee Remote Thread Creation

Jun 20, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects remote thread injection events based on action seen used by bumblebee

Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.44877 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Potential COLDSTEEL Persistence Service DLL Creation

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Potential COLDSTEEL Persistence Service DLL Load

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Potential COLDSTEEL RAT File Indicators

Jun 20, 2023 · attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Execution

Jun 20, 2023 · attack.defense_evasion attack.t1218 attack.execution detection.emerging_threats ·

Share on:

Detects execution of known compromised version of 3CXDesktopApp

Potential Compromised 3CXDesktopApp ICO C2 File Download

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Potential Compromised 3CXDesktopApp Update Activity

Jun 20, 2023 · attack.defense_evasion attack.t1218 attack.execution detection.emerging_threats ·

Share on:

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

Potential Conti Ransomware Activity

Jun 20, 2023 · attack.impact attack.s0575 attack.t1486 detection.emerging_threats ·

Share on:

Detects a specific command used by the Conti ransomware group

Potential Conti Ransomware Database Dumping Activity Via SQLCmd

Jun 20, 2023 · attack.collection attack.t1005 detection.emerging_threats ·

Share on:

Detects a command used by conti to dump database

Potential CVE-2021-26857 Exploitation Attempt

Jun 20, 2023 · attack.t1203 attack.execution cve.2021.26857 detection.emerging_threats ·

Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

Potential CVE-2021-27905 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.27905 detection.emerging_threats ·

Share on:

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Potential CVE-2021-40444 Exploitation Attempt

Jun 20, 2023 · attack.execution attack.t1059 cve.2021.40444 detection.emerging_threats ·

Share on:

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

Potential CVE-2021-41379 Exploitation Attempt

Jun 20, 2023 · attack.privilege_escalation attack.t1068 cve.2021.41379 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Potential CVE-2021-42278 Exploitation Attempt

Jun 20, 2023 · attack.credential_access attack.t1558.003 cve.2021.42278 detection.emerging_threats ·

Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Potential CVE-2022-21587 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.21587 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.

Potential CVE-2022-26809 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1569.002 cve.2022.26809 detection.emerging_threats ·

Share on:

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

Potential CVE-2022-29072 Exploitation Attempt

Jun 20, 2023 · attack.execution cve.2022.29072 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

Potential CVE-2022-46169 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2022.46169 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

Potential CVE-2023-2283 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.2283 detection.emerging_threats ·

Share on:

Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Jun 20, 2023 · attack.exfiltration cve.2023.23397 detection.emerging_threats ·

Share on:

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Potential CVE-2023-23752 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.23752 detection.emerging_threats ·

Share on:

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Potential CVE-2023-25157 Exploitation Attempt

Jun 20, 2023 · attack.initial_access cve.2023.25157 detection.emerging_threats ·

Share on:

Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer

Potential CVE-2023-25717 Exploitation Attempt

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.25717 detection.emerging_threats ·

Share on:

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Potential Devil Bait Malware Reconnaissance

Jun 20, 2023 · attack.execution attack.t1218 detection.emerging_threats ·

Share on:

Detects specific process behavior observed with Devil Bait samples

Potential Devil Bait Related Indicator

Jun 20, 2023 · attack.defense_evasion detection.emerging_threats ·

Share on:

Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC

Potential Dridex Activity

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging_threats ·

Share on:

Detects potential Dridex acitvity via specific process patterns

Potential Dtrack RAT Activity

Jun 20, 2023 · attack.impact attack.t1490 detection.emerging_threats ·

Share on:

Detects potential Dtrack RAT activity via specific process patterns

Potential Emotet Activity

Jun 20, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 detection.emerging_threats ·

Share on:

Detects all Emotet like process executions that are not covered by the more generic rules

Potential Emotet Rundll32 Execution

Jun 20, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

Potential EmpireMonkey Activity

Jun 20, 2023 · attack.defense_evasion attack.t1218.010 detection.emerging_threats ·

Share on:

Detects potential EmpireMonkey APT activity

Potential Exploitation Attempt From Office Application

Jun 20, 2023 · attack.execution attack.defense_evasion cve.2021.40444 detection.emerging_threats ·

Share on:

Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

Potential Goofy Guineapig Backdoor Activity

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

Potential Goofy Guineapig GoolgeUpdate Process Anomaly

Jun 20, 2023 · attack.defense_evasion detection.emerging_threats ·

Share on:

Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor

Potential Ke3chang/TidePool Malware Activity

Jun 20, 2023 · attack.g0004 attack.defense_evasion attack.t1562.001 detection.emerging_threats ·

Share on:

Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020

Potential Maze Ransomware Activity

Jun 20, 2023 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging_threats ·

Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Potential MOVEit Transfer CVE-2023-34362 Exploitation

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2023.34362 detection.emerging_threats ·

Share on:

Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

Potential MuddyWater APT Activity

Jun 20, 2023 · attack.defense_evasion attack.execution attack.g0069 detection.emerging_threats ·

Share on:

Detects potential Muddywater APT activity

Potential Operation Triangulation C2 Beaconing Activity - DNS

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Potential Operation Triangulation C2 Beaconing Activity - Proxy

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Potential OWASSRF Exploitation Attempt - Webserver

Jun 20, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Potential PlugX Activity

Jun 20, 2023 · attack.s0013 attack.defense_evasion attack.t1574.002 detection.emerging_threats ·

Share on:

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Potential POWERTRASH Script Execution

Jun 20, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects potential execution of the PowerShell script POWERTRASH

Potential Qakbot Rundll32 Execution

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

Potential QBot Activity

Jun 20, 2023 · attack.execution attack.t1059.005 detection.emerging_threats ·

Share on:

Detects potential QBot activity by looking for process executions used previously by QBot

Potential Raspberry Robin Dot Ending File

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin

Potential Russian APT Credential Theft Activity

Jun 20, 2023 · attack.credential_access attack.t1552.001 attack.t1003.003 detection.emerging_threats ·

Share on:

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

Potential Ryuk Ransomware Activity

Jun 20, 2023 · attack.persistence attack.t1547.001 detection.emerging_threats ·

Share on:

Detects Ryuk ransomware activity

Potential SNAKE Malware Installation Binary Indicator

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report

Potential SNAKE Malware Installation CLI Arguments Indicator

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

Potential SNAKE Malware Persistence Service Execution

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.

Potential Snatch Ransomware Activity

Jun 20, 2023 · attack.execution attack.t1204 detection.emerging_threats ·

Share on:

Detects specific process characteristics of Snatch ransomware word document droppers

Potential Suspicious Child Process Of 3CXDesktopApp

Jun 20, 2023 · attack.command_and_control attack.execution attack.t1218 detection.emerging_threats ·

Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Potential SystemNightmare Exploitation Attempt

Jun 20, 2023 · attack.privilege_escalation attack.t1068 detection.emerging_threats ·

Share on:

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

Ps.exe Renamed SysInternals Tool

Jun 20, 2023 · attack.defense_evasion attack.g0035 attack.t1036.003 car.2013-05-009 detection.emerging_threats ·

Share on:

Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report

Pulse Connect Secure RCE Attack CVE-2021-22893

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.22893 detection.emerging_threats ·

Share on:

This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

Pulse Secure Attack CVE-2019-11510

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2019.11510 detection.emerging_threats ·

Share on:

Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

Qakbot Regsvr32 Calc Pattern

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Qakbot Rundll32 Exports Execution

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Qakbot Rundll32 Fake DLL Extension Execution

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

Rejetto HTTP File Server RCE

Jun 20, 2023 · attack.initial_access attack.t1190 attack.t1505.003 cve.2014.6287 detection.emerging_threats ·

Share on:

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

REvil Kaseya Incident Malware Patterns

Jun 20, 2023 · attack.execution attack.t1059 attack.g0115 detection.emerging_threats ·

Share on:

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

Rhadamanthys Stealer Module Launch Via Rundll32.EXE

Jun 20, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023

Rorschach Ransomware Execution Activity

Jun 20, 2023 · attack.execution attack.t1059.003 attack.t1059.001 attack.defense_evasion detection.emerging_threats ·

Share on:

Detects Rorschach ransomware execution activity

Serv-U Exploitation CVE-2021-35211 by DEV-0322

Jun 20, 2023 · attack.persistence attack.t1136.001 cve.2021.35211 detection.emerging_threats ·

Share on:

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Sitecore Pre-Auth RCE CVE-2021-42237

Jun 20, 2023 · attack.initial_access attack.t1190 cve.2021.42237 detection.emerging_threats ·

Share on:

Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237 found in Report.ashx

Small Sieve Malware CommandLine Indicator

Jun 20, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Small Sieve Malware File Indicator Creation

Jun 20, 2023 · attack.defense_evasion attack.t1036.005 detection.emerging_threats ·

Share on:

Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.

Small Sieve Malware Potential C2 Communication

Jun 20, 2023 · attack.command_and_control detection.emerging_threats ·

Share on:

Detects potential C2 communication related to Small Sieve malware

SNAKE Malware Covert Store Registry Key

Jun 20, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

SNAKE Malware Installer Name Indicators

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

SNAKE Malware Kernel Driver File Indicator

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects SNAKE malware kernel driver file indicator

SNAKE Malware Service Persistence

Jun 20, 2023 · attack.persistence detection.emerging_threats ·

Share on:

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

SNAKE Malware WerFault Persistence File Creation

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity

Sofacy Trojan Loader Activity

Jun 20, 2023 · attack.defense_evasion attack.execution attack.g0007 attack.t1059.003 attack.t1218.011 car.2013-10-002 detection.emerging_threats ·

Share on:

Detects Trojan loader activity as used by APT28

Solarwinds SUPERNOVA Webshell Access

Jun 20, 2023 · attack.persistence attack.t1505.003 detection.emerging_threats ·

Share on:

Detects access to SUPERNOVA webshell as described in Guidepoint report

SonicWall SSL/VPN Jarrewrite Exploitation

Jun 20, 2023 · attack.t1190 attack.initial_access detection.emerging_threats ·

Share on:

Detects exploitation attempts of the SonicWall Jarrewrite Exploit

SOURGUM Actor Behaviours

Jun 20, 2023 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege_escalation detection.emerging_threats ·

Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Successful Exchange ProxyShell Attack

Jun 20, 2023 · attack.initial_access detection.emerging_threats ·

Share on:

Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

Suspicious PrinterPorts Creation (CVE-2020-1048)

Jun 20, 2023 · attack.persistence attack.execution attack.t1059.001 cve.2020.1048 detection.emerging_threats ·

Share on:

Detects new commands that add new printer port which point to suspicious file

Suspicious RazerInstaller Explorer Subprocess

Jun 20, 2023 · attack.privilege_escalation attack.t1553 detection.emerging_threats ·

Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Suspicious VBScript UN2452 Pattern

Jun 20, 2023 · attack.persistence attack.t1547.001 detection.emerging_threats ·

Share on:

Detects suspicious inline VBScript keywords as used by UNC2452

TAIDOOR RAT DLL Load

Jun 20, 2023 · attack.execution attack.t1055.001 detection.emerging_threats ·

Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

TerraMaster TOS CVE-2020-28188

Jun 20, 2023 · attack.t1190 attack.initial_access cve.2020.28188 detection.emerging_threats ·

Share on:

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Trickbot Malware Activity

Jun 20, 2023 · attack.execution attack.t1559 detection.emerging_threats ·

Share on:

Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"

TropicTrooper Campaign November 2018

Jun 20, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

Turla Group Commands May 2020

Jun 20, 2023 · attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging_threats ·

Share on:

Detects commands used by Turla group as reported by ESET in May 2020

Turla Group Lateral Movement

Jun 20, 2023 · attack.g0010 attack.execution attack.t1059 attack.lateral_movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging_threats ·

Share on:

Detects automated lateral movement by Turla group

UNC2452 PowerShell Pattern

Jun 20, 2023 · attack.execution attack.t1059.001 attack.t1047 detection.emerging_threats ·

Share on:

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

UNC2452 Process Creation Patterns

Jun 20, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

UNC4841 - Barracuda ESG Exploitation Indicators

Jun 20, 2023 · attack.execution attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

UNC4841 - Download Compressed Files From Temp.sh Using Wget

Jun 20, 2023 · attack.defense_evasion attack.t1140 detection.emerging_threats ·

Share on:

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

UNC4841 - Download Tar File From Untrusted Direct IP Via Wget

Jun 20, 2023 · attack.defense_evasion attack.t1140 detection.emerging_threats ·

Share on:

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

UNC4841 - Email Exfiltration File Pattern

Jun 20, 2023 · attack.execution attack.persistence attack.defense_evasion detection.emerging_threats ·

Share on:

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

UNC4841 - Potential SEASPY Execution

Jun 20, 2023 · attack.execution detection.emerging_threats ·

Share on:

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

UNC4841 - SSL Certificate Exfiltration Via Openssl

Jun 20, 2023 · attack.defense_evasion attack.t1140 detection.emerging_threats ·

Share on:

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.