dist.public | Detection.FYI

Disable Windows Defender via Service

Feb 26, 2024 · attack.execution attack.t1569.002 attack.t1562.001 dist.public ·
Share on:

Detects Windows Defender disabling service installation

Read More
JavaScript Execution Using MSDOS 8.3 File Notation

Feb 26, 2024 · attack.defense_evasion attack.t1059 dist.public ·
Share on:

Detects script execution using MSDOS 8.3 File names

Read More
FlawedGrace spawning threat injection target

Feb 23, 2024 · attack.defense_evasion attack.t1055 dist.public ·
Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Read More
List remote processes using tasklist

Feb 23, 2024 · attack.discovery attack.t1057 dist.public ·
Share on:

Detecting the use of tasklist to display processes of remote hosts using the /S parameter.

Read More
Nullsoft Scriptable Installer Script (NSIS) execution

Feb 23, 2024 · attack.execution attack.t1106 dist.public ·
Share on:

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Nullsoft Scriptable Installer Script (NSIS) file creation

Feb 23, 2024 · attack.execution attack.t1106 dist.public ·
Share on:

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Read More
Viewing remote directories

Feb 23, 2024 · attack.discovery attack.t1083 dist.public ·
Share on:

Detecting the use of dir command to inspect directories on the remote host.

Read More
NetScan Share Enumeration Write Access Check

Jan 29, 2024 · attack.discovery attack.t1135 dist.public ·
Share on:

Detects the creation of unique artifacts created by SoftPerfect NetScan when performing write-access checking on enumerated network shares

Read More
Conhost Suspicious Command Execution

Nov 1, 2023 · attack.defense_evasion attack.t1564.003 dist.public ·
Share on:

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Read More