dist.public

Conhost Suspicious Command Execution

Mar 18, 2025 · attack.defense-evasion attack.t1564.003 dist.public ·

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

FlawedGrace spawning threat injection target

Mar 18, 2025 · attack.defense-evasion attack.t1055 dist.public ·

Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Invoke-ShareFinder Module Load Detection

Mar 18, 2025 · attack.discovery attack.t1135 dist.public ·

Share on:

Use of Invoke-ShareFinder detected via PowerShell logging

Invoke-ShareFinder Script Block Execution

Mar 18, 2025 · attack.discovery attack.t1135 dist.public ·

Share on:

Use of Invoke-ShareFinder detected via PowerShell Script Block logging

JavaScript Execution Using MSDOS 8.3 File Notation

Mar 18, 2025 · attack.defense-evasion attack.t1059 dist.public ·

Share on:

Detects script execution using MSDOS 8.3 File names

Viewing remote directories

Mar 18, 2025 · attack.discovery attack.t1083 dist.public ·

Share on:

Detecting the use of dir command to inspect directories on the remote host.

List remote processes using tasklist

Aug 2, 2024 · attack.discovery attack.t1057 dist.public ·

Share on:

Detecting the use of tasklist to display processes of remote hosts using the /S parameter.

NetScan Share Enumeration Write Access Check

Aug 2, 2024 · attack.discovery attack.t1135 dist.public ·

Share on:

Detects the creation of unique artifacts created by SoftPerfect NetScan when performing write-access checking on enumerated network shares

Nullsoft Scriptable Installer Script (NSIS) execution

Aug 2, 2024 · attack.execution attack.t1106 dist.public ·

Share on:

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Nullsoft Scriptable Installer Script (NSIS) file creation

Aug 2, 2024 · attack.execution attack.t1106 dist.public ·

Share on:

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Disable Windows Defender via Service

Feb 26, 2024 · attack.execution attack.t1569.002 attack.t1562.001 dist.public ·

Share on:

Detects Windows Defender disabling service installation