dist.public | Detection.FYI

Nullsoft Scriptable Installer Script (NSIS) execution

Aug 26, 2023 · attack.execution attack.T1106 dist.public ·
Share on:

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
FlawedGrace spawning threat injection target

Jun 11, 2023 · attack.attack.defense_evasion attack.T1631 dist.public ·
Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Read More
List remote processes using tasklist

Jun 11, 2023 · attack.discovery attack.T1057 dist.public ·
Share on:

Detecting the use of tasklist to display processes of remote hosts using the /S parameter.

Read More
Nullsoft Scriptable Installer Script (NSIS) execution

Jun 11, 2023 · attack.execution attack.T1106 dist.public ·
Share on:

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Viewing remote directories

Jun 11, 2023 · attack.discovery attack.T1083 dist.public ·
Share on:

Detecting the use of dir command to inspect directories on the remote host.

Read More