process_creation

Operator Bloopers Cobalt Strike Commands

Mar 18, 2025 · attack.execution attack.t1059.003 stp.1u ·

Share on:

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Bumblebee WmiPrvSE execution pattern

Mar 18, 2025 · attack.defense-evasion attack.t1036 ·

Share on:

Detects Bumblebee WmiPrvSE parent process manipulation

Conhost Suspicious Command Execution

Mar 18, 2025 · attack.defense-evasion attack.t1564.003 dist.public ·

Share on:

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Custom Cobalt Strike Command Execution

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 attack.execution attack.t1059.001 ·

Share on:

Detects the execution of a specific OneLiner to Invoke PowerShell commands.

Deleting Windows Defender scheduled tasks

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the deletion of scheduled tasks related to Windows Defender.

Enable WDigest using PowerShell

Mar 18, 2025 · attack.defense-evasion attack.t1112 ·

Share on:

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Enabling RDP service via reg.exe command execution

Mar 18, 2025 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·

Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Enabling restricted admin mode

Mar 18, 2025 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects the registry modification to enable restricted admin mode using reg.exe

Exchange WebShell Creation

Mar 18, 2025 · attack.t1505.003 attack.persistence attack.t1190 attack.initial-access ·

Share on:

These commands were used to create a WebShell by exploiting ProxyShell vulnerabilities

Execution of ZeroLogon PoC executable

Mar 18, 2025 · attack.execution attack.lateral-movement attack.t1210 ·

Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

FlawedGrace spawning threat injection target

Mar 18, 2025 · attack.defense-evasion attack.t1055 dist.public ·

Share on:

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Hiding local user accounts

Mar 18, 2025 · attack.t1564.002 attack.defense-evasion ·

Share on:

Detects the use reg.exe to hide users from listed in the logon screen. This is possible by changing the registry key value to 0 for a specific user.

JavaScript Execution Using MSDOS 8.3 File Notation

Mar 18, 2025 · attack.defense-evasion attack.t1059 dist.public ·

Share on:

Detects script execution using MSDOS 8.3 File names

Lazagne dumping credentials

Mar 18, 2025 · attack.credential-access attack.t1555 ·

Share on:

Detects the use of lazagne using command line execution.

Mimikatz Command Line With Ticket Export

Mar 18, 2025 · attack.credential-access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community