The following table lists the Trellix indicators that are shipped with the module.
Name | Description | Target |
|---|---|---|
ARCHIVE FILES | Adversaries may use various utilities to archive files in Linux. This is associated with MITRE | linux |
ARCHIVE FILES VIA PYTHON | Adversaries may use various python libraries to archive files in Linux. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1560.002. | linux |
ARCHIVE WITH SSH FILES LINUX (METHODOLOGY) | This IOC detects an adversary enumerating and gathering all ssh keys and files located on a compromised device. SSH keys consist of a public and private key that are used to authenticate with the SSH server. Adversaries can gather these keys and attempt to log in to the server to move laterally in a network. This is associated with MITRE ATT&CK (r) | linux |
AT (UTILITY) | Adversaries can use AT utility in Linux to establish persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): | linux |
AUTOSTART SERVICE ON BOOT (METHODOLOGY) | Systemd utilizes configuration files known as service units to control how services boot and under what conditions. To start a service on boot by default, a symlink of the service file must be placed in the multi-user.target.wants directory. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.002. | linux |
AXETERROR (BACKDOOR) | AXETERROR is a Go compiled backdoor related to Exaramel backdoor family. This malware creates a persistence task based on the operating system configurations and has the capability to execute commands on the system and send the stored results to a remote command and control server. | linux |
BASE64 ENCODING (METHODOLOGY) | Adversaries often use base64 encoding to obfuscate their payloads. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Command and Control and Technique(s): T1027, T1132.001. | linux |
BASH_PROFILE AND BASHRC | Attackers can add their program to ~/.bash_profile to execute on every login shell or to ~/.bashrc to execute on every interactive non-login shell. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.004. | linux |
BINARY PADDING USING DD (METHODOLOGY) | This IOC detects modification of a file by appending junk characters to the end of a file. This technique is used by attacker to change the hash of the file. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1027.001. | linux |
CHAGE (UTILITY) | Attackers can use chage utility to view or change password policies to their advantage, for example: they can make their passwords for their backdoor accounts to never expire so that they do not lose access. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery | linux |
CHANGING FILE OWNER OR GROUP LINUX (METHODOLOGY) | This IOC detects the command line for changing file owner or group.This can lock other users out of access to the file, thus hampering removal or inspection. It may also be required in order to execute a file in certain, elevated context.This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense Evasion and Technique(s): T1548.001. | linux |
CHANGING GROUP COMMAND RECURSIVELY LINUX (METHODOLOGY) | This IOC detects the command line for changing the group ownership recursively which can be abused to elevate priviledges.This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense Evasion and Technique(s): T1548.001. | linux |
CHMOD (UTILITY) | CHMOD is a utility to change the access permissions of files and directories. This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense Evasion and Technique(s): T1548.001. | linux |
CLEAR LOGS (METHODOLOGY) | Adversaries may clear logs to hide their tracks. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.002. | linux |
CLEARING SESSION COMMAND HISTORY LINUX (METHODOLOGY) | When commands are executed via the command-line, they are stored in the session's history. This IOC detects a threat actor removing the commands saved by the terminal's session history. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion, Impact and Technique(s): T1059.004, T1070.003, T1565.001. | linux |
COOKIEJAR (BACKDOOR) | COOKIEJAR is a malicious apache plugin which intercepts SSL connections to the webserver. The malware which is dropped through webshell monitors for specific URI requests and executes code on the infected system. This is associated to MITRE ATT&CK (r) Tactic: Persistence and Technique: T1505.003 | linux |
COPYING SHELL TO NEW LOCATION (METHODOLOGY) | This IOC detects the creation of the shell from a directory masquerading as the current parent directory. Attackers can copy the shell binary to a new location and then executes against the copy of shell. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | linux |
CREDENTIAL DUMPING LINUX (METHODOLOGY) | Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Execution, Discovery and Technique(s): T1003.008, T1059.004, T1087.001. | linux |
CRON (UTILITY) | Adversaries can use CRON utility in Linux to establish persistence. Note that builtin commands like echo can also be used to write to crontab file and since builtin command executions are not captured in process command line, this IOC looks generically for presence of crontab files in any process command line which does not necessarily mean that a cron job is being created. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation, Defense Evasion and Technique(s): T1053.003, T1036.003. | linux |
CRONTAB (UTILITY) | Attackers may use cron utility to establish persistence on the system. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.003. | linux |
CURL INSECURE EXECUTION LINUX (METHODOLOGY) | curl is a tool to transfer data from or to a server, using various protocols. Although curl can be used for benign operations, source endpoints should be investigated if there is no authorized use of curl to work in insecure mode in the environment. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Command And Control and Technique(s): T1059.004, T1564, T1105. | linux |
CURL SILENT EXECUTION LINUX (METHODOLOGY) | curl is a tool to transfer data from or to a server, using various protocols. Although curl can be used for benign operations, source endpoints should be investigated if there is no authorized use of curl to work in silent mode in the environment. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Command And Control and Technique(s): T1059.004, T1564, T1105. | linux |
DD (UTILITY) | Adversaries may use dd utility to overwrite files. This is associated with MITRE ATT&CK (r) Tactic(s): Impact, Defense Evasion and Technique(s): T1485, T1070.002. | linux |
DETECTING INIT SYSTEM USING SHELL (METHODOLOGY) | This IOC detects a common commandline used to determine which init system is on a linux server as we have differet variants for different linux OS. With this information, the attackers may create or modify systemd services to repeatedly execute malicious payloads.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.002. | linux |
DISABLE SYSLOG (METHODOLOGY) | Adversaries may disable syslog service to disable system logging. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | linux |
DUMPING KERNEL SYMBOLS TO TMP FILE (METHODOLOGY) | This IOC detects the dumping of the symbol list into a temporary file in the root directory. It can then be used to extract the memory address of several functions and kernel variables and store them in memory for future use. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.006. | linux |
ENCRYPT FILES (METHODOLOGY) | Adversaries may use various utilities to encrypt files in Linux. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1486. | linux |
ENUMERATION OF OS INFORMATION (METHODOLOGY) | This IOC detets enumeration of OS information. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | linux |
ENUMERATION OF SSH FILES LINUX (METHODOLOGY) | This IOC detects an adversary enumerating all ssh keys and files located on a compromised device. SSH keys consist of a public and private key that are used to authenticate with the SSH server. Adversaries can gather these keys and attempt to log in to the server to move laterally in a network. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1005, T1059.004. | linux |
ENUMERATION OF SYSTEM INFORMATION LINUX (METHODOLOGY) | Various native built-in commands can be executed to pull back a variety of information including software version, firewall settings, and network connections. This IOC detects the gathering of basic system information from a Linux machine. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1016, T1033, T1049, T1057, T1059.004, T1082, T1087.001, T1087.002. | linux |
ENV (UTILITY) | This IOC detects the execution of env which can be used to list environment variables. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | linux |
EXFILTRATION OF SSH FILES LINUX (METHODOLOGY) | This IOC detects exfiltration of ssh keys and files located on a compromised device. SSH keys consist of a public and private key that are used to authenticate with the SSH server. Adversaries can gather these keys and attempt to log in to the server to move laterally in a network. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and | linux |
FILE (UTILITY) | FILE is a utility used to determine the type of a file. This is associated with MITRE ATT&CK | linux |
FILE AND FOLDER DELETION LINUX (METHODOLOGY) | Adversaries may delete files and/or folders left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Adversaries may also destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion, Impact and Technique(s): T1059.004, T1070.004, T1485. | linux |
FILE AND FOLDER DISCOVERY LINUX (METHODOLOGY) | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Discovery and Technique(s): T1059.004, T1083. | linux |
FILE DOWNLOADS VIA CURL LINUX (METHODOLOGY) | curl is a tool to transfer data from or to a server, using various protocols. Although curl can be used for benign operations, source endpoints should be investigated if there is no authorized use of curl for downloads in the environment. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1105, T1059.004. | linux |
FILE MODE CHANGED TO EXECUTABLE LINUX (METHODOLOGY) | Attackers can use chmod utility to add executable attribute to the file and run it successfully on the victim machine. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
FILESYSTEM DELETION LINUX (METHODOLOGY) | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Impact and Technique(s): T1059.004, T1070.004, T1485. | linux |
FILTERING INFORMATION ABOUT SYSTEM (METHODOLOGY) | This IOC detects the execution of command grep which can be used to filter the information about the system along with the use of various other commands. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
GET (UTILITY) | GET utility is used to copy data from a remote environment to files in a directory in the local UNIX environment. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and | linux |
HIDDEN FOLDER (METHODOLOGY) | Adversaries may create hidden folders to avoid user suspicion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1564.001. | linux |
HISTCONTROL (METHODOLOGY) | HISTCONTROL can be used to control which commands will be saved in bash history. Attackers can specify ignorespace,ignoredups or ignoreboth as value of HISTCONTROL and then use it to their advantage for example by using commands starting with spaces to avoid traces of their commands in bash history. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.003. | linux |
IMPORT (UTILITY) | Adversaries may use import utility to take screenshots. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1113. | linux |
INGRESS TOOL TRANSFER (METHODOLOGY) | Adversaries may transfer files and tools from a remote system into a compromised host. This IOC detects the various utilities that could be used for file transfer. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1105, T1059.004. | linux |
INTERCEPTER NG (UTILITY) | Intercepter NG is an utility which is used to perform man-in-the-middle attacks. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Discovery and Technique(s): T1040. | linux |
KEEPING CONTAINER ALIVE (METHODOLOGY) | This IOC detects the commandline which uses tail utility in linux to keep the container alive and running which helps in executing the shell scripts indefinitely.This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.003, T1053.007. | linux |
KEXTLOAD (UTILITY) | KEXTLOAD is a utility used to explicitly load kernel extensions. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.006. | linux |
LDAPSEARCH (UTILITY) | LDAPSEARCH is a utility that opens a connection to an LDAP server, binds to it, and performs a search using a filter. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1069.002. | linux |
LINPEAS (UTILITY) | LinPEAS is a script that search for possible paths to escalate privileges on Linux. Attackers may enumerate all the possible ways or methods to elevate privileges This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense Evasion and Technique(s): T1548.003. | linux |
LN (UTILITY) | LN is a utility used to create a hard link or a symbolic link (symlink) to an existing file or directory. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.002. | linux |
LOCAL ACCOUNT DISCOVERY (METHODOLOGY) | Adversaries may attempt to discover local accounts during local reconnaissance. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1087.001. | linux |
LOCAL GROUPS DISCOVERY (METHODOLOGY) | Adversaries may attempt to find local groups. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1069.001. | linux |
LSMOD (UTILITY) | Attackers may use lsmod utility to list the linux modules. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | linux |
MODIFICATION OF HOSTS FILE LINUX (METHODOLOGY) | This IOC detects the modification of the hosts file. The host file is often used to sinkhole network communications for security products. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery, Execution and Technique(s): T1018, T1562.001, T1059.004. | linux |
MSFVENOM COMMAND LINE INTERFACE (UTILITY) | Msfvenom is a command line instance of Metasploit that is used to generate and output all of the various types of shell code that are available in Metasploit. Attackers may create malicious payloads and encode these payloads using various encoder modules. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
NETWORK PROXY CHANGED USING HTTP_PROXY (METHODOLOGY) | Attackers sometimes change the HTTP proxy to redirect all the network to their command and control server. This IOC looks for possible modification of HTTP proxy by exporting HTTP_PROXY environment variable. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1090.001. | linux |
NETWORK SNIFFING (METHODOLOGY) | Adversaries may use various utilities like tcpdump to do network sniffing. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Discovery and Technique(s): T1040. | linux |
NSLOOKUP EXECUTION | This IOC detects the use of the nslookup utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | linux |
OPENSSH CONFIGURATION (UTILITY) | This IOC detects the OpenSSH daemon configuration. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence and Technique(s): T1098.004. | linux |
OPENSSL USAGE (METHODOLOGY) | This IOC detects the use of openssl utility. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1132. | linux |
PAM LOG PASSWORDS (METHODOLOGY) | Adversaries may log user passwords by changing the PAM configuration files. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Credential Access and Technique(s): T1056.001. | linux |
PASSWORD POLICY DISCOVERY (METHODOLOGY) | Attackers discover password policies by reading configuration files which can help them in the next phases of the attack. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Credential Access, Defense Evasion, Persistence and Technique(s): T1201, T1556.003. | linux |
PING (UTILITY) | Ping utility can be used to discover remote machines on a network. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | linux |
POSSIBLE REMOTE ACCESS SERVICES LINUX (METHODOLOGY) | This IOC detects execution of different remote access services within the system. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Lateral Movement and Technique(s): T1105, T1219, T1021.005 | linux |
POTENTIAL BASH REVERSE SHELL LINUX (METHODOLOGY) | This IOC detects the reverse shell written in bash commands. Kindly investigate the source of the activity to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
POTENTIAL CREDENTIAL DUMPING (METHODOLOGY) | This IOC detects some indicators associated with domain credential dumping and suspicious login attempt from an infected host. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement, Execution, Persistence, Privilege Escalation, Initial Access and Technique(s): T1550.002, T1059.004, T1078. | linux |
POTENTIAL LOGIN ATTEMPT THROUGH VNC (METHODOLOGY) | Adversaries may access hosts using valid accounts through Virtual Network Computing (VNC). This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.005. | linux |
POTENTIAL SSH EXFILTRATION (METHODOLOGY) | Adversaries may use SSH for exfiltration of data. This is associated with MITRE ATT&CK (r) Tactic(s): Exfiltration and Technique(s): T1048. | linux |
POTENTIAL TAMPERING OF AUDITD CONFIGURATION (METHODOLOGY) | Adversaries may tamper with auditd configuration for evasion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.006. | linux |
POTENTIAL TAMPERING OF SYSLOG CONFIGURATION | Adversaries may tamper with syslog configuration for evasion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.006. | linux |
PROCESS CREATION FROM DELETED IMAGE | This IOC detects the forking of new process from deleted elf file. Malware will delete its executable from the its directory inside /proc to avoid detection and analysis. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.004. | linux |
PYTHON EXECUTION | Adversaries may use python commands or scripts for execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.006. | linux |
QUIETPULSE (BACKDOOR) | QUIETPULSE utility is a shell script invoked by a malicious version of dsserver that primarily functions as a utility script responsible for copying files and executing commands that has been seen during CVE-2021-22893 exploitation. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Defense Evasion and Technique(s): T1059.004, T1554, T1036.005. | linux |
REMOTE FILE COPY TOOLS (METHODOLOGY) | This IOC looks for linux tools that can be used to copy files from and to remote machines. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Lateral Movement and Technique(s): T1105, T1570. | linux |
REMOTE SYSTEM DISCOVERY LINUX (METHODOLOGY) | Attackers can leverage utilities like arp, nmap, etc. to discover the information on remote systems in a network. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1016, T1018, T1049, T1059.004, T1046. | linux |
REMOTE SYSTEM DISCOVERY VIA SWEEP LINUX (METHODOLOGY) | Attackers can leverage ping utility to discover the information on remote systems in a network by running a ping sweep. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1016, T1049, T1059.004, T1018. | linux |
ROOT SSH LOGIN USING SSHPASS VIA PASSWORD (METHODOLOGY) | This IOC detects the usage of sshpass utility attempting to ssh login as a root user using password.This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.004. | linux |
ROOT SSH LOGIN USING SSHPASS VIA SSHKEY (METHODOLOGY) | This IOC detects the usage sshpass utility & attempts to ssh login as a root user using sshkey.This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.004. | linux |
RSYSLOG (UTILITY) | Rsyslog is a system utility providing support for message logging for both local and remote machines which attackers can run for recording sensitive details.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.002. | linux |
RUNNING RC SCRIPTS DURING BOOT (METHODOLOGY) | This IOC detects the suspicious commandline by which adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local.Upon reboot, the system executes the script's contents as root, resulting in persistence.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1037.004. | linux |
SECURITY SOFTWARE DISCOVERY (METHODOLOGY) | Adversaries may try to discover the security software installed on the machine. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1518.001. | linux |
SERVICE (METHODOLOGY) | Adversaries can create or modify systemd service to achieve persistence and privilege escalation. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.002. | linux |
SETTING IMMUTABLE BIT TO FILE (METHODOLOGY) | This IOC sets the file with an immutable attribute by which the user cannot modify, rename, delete and link the file by anyone including the root user, thus attackers after entering the system can install the service and set this bit to prevent deletion.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.002. | linux |
SETUID AND SETGID (METHODOLOGY) | Attackers may set setuid or setgid bits on malicious executables to execute with elevated privileges. This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense | linux |
SHARED LIBRARY MODIFICATION (METHODOLOGY) | This IOC detects addition of new shared libraries. Attacker can set this value pointing to malicious library file & during execution shared library will also get called. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1055. | linux |
SHELL SCRIPT LINUX (METHODOLOGY) | This IOC detects various operations on a shell script such as creation, modification, download, execution, etc. Source endpoints should be investigated if there is no authorized use of shell scripts in the environment. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
SMBSTATUS (UTILITY) | Adversaries may use smbstatus utility to discover network shares. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1135. | linux |
SSH LOGIN ATTEMPT USING LOCAL KEY FILE | Adversaries may use valid accounts to log into remote machines using Secure Shell (SSH). This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement, Defense Evasion, Persistence, Privilege Escalation, Initial Access and Technique(s): T1021.004, T1078.001, T1078.002, T1078.003. | linux |
SUDO STDIN PASSWORD READ (METHODOLOGY) | When pwfeedback option is enabled in sudoers file, a user on the host could trigger a stack - based buffer overflow (CVE-2019-18634) in sudo which can be used for privilege escalation. This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense | linux |
SUSPICIOUS ACCESS OF CREDENTIAL STORE LINUX | This IOC detects suspicious access of password and user account files on a Linux host. This technique is used by malware during setting up of a custom local account for remote persistent access. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, | linux |
SUSPICIOUS ACCESS OF SENSITIVE FILES (METHODOLOGY) | Adversaries may search local system to find files of interest and sensitive data prior to Exfiltration. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and | linux |
SUSPICIOUS ACCESS TO WINDOWS SMB SHARES | Malware could access and attain lateral movement though SMB file shares. This IOC detects suspicious SMB connections from a Linux machine. This is associated with MITRE | linux |
SUSPICIOUS ATTEMPT TO MODIFY SSH CONFIGURATION | This IOC detects suspicious modification of Secure Shell configurations to allow specific connections to the infected host. This technique is used by malware during setting up of a custom local account for remote persistent access. This is associated with MITRE ATT&CK Movement and Technique(s): T1021.004, T1078.003. | linux |
SUSPICIOUS ATTEMPT TO UPLOAD CROWN PLUGIN LINUX (EXPLOIT) | This IOC detects suspicious connection to a Atlassian Crowd server over a non-TLS channel to upload plugin file. This could be an attempt to exploit CVE-2019-11580. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access and Technique(s): T1190. | linux |
SUSPICIOUS CHILD PROCESS FROM FIREFOX (EXPLOIT) | This IOC detects suspicious creation of new process from firefox. This could be due to a potential exploitation of vulnerability in firefox or one of the installed addons for remote code execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Initial Access | linux |
SUSPICIOUS CODE EXECUTION FROM VIM | This IOC detects suspicious code execution from vim editor. This could be due to a potential exploitation of modeline feature through specially crafted file. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1203. | linux |
SUSPICIOUS COLLECTION OF SYSTEM INFORMATION | This IOC detects the various commands used for collecting process and resources information on an infected host. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery,Execution and Technique(s): T1082, T1059.004. | linux |
SUSPICIOUS CRYPTOMINING ACTIVITY A | Attackers sometimes deploy cryptominers to make profit by mining crytpo currency. This IOC looks for the network protocols associated with crypto mining. Kindly investigate the source of activity to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1496. | linux |
SUSPICIOUS DATA TRANSFER IN BYTES | An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts. This is associated with MITRE ATT&CK (r) Tactic(s): Exfiltration and Technique(s): T1030. | linux |
SUSPICIOUS EXECUTION OF CURL (METHODOLOGY) | This IOC detects the suspicious execution of curl command to download files from a remote server using a self signed certificate without any output message. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | linux |
SUSPICIOUS FILE DELETION (METHODOLOGY) | Malware tend to delete the file system indicators to avoid leaving traces on infection on the victim host. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement and Technique(s): T1070.004 | linux |
SUSPICIOUS FILE READ | Use of the cat utility to view the contents of a file. This is associated with MITRE ATT&CK (r) | linux |
SUSPICIOUS GREP USAGE | This IOC detects the suspicious usage of GREP command. This is associated with MITRE | linux |
SUSPICIOUS HIDDEN FILE IN CONFIGURATION DIRECTORY | This IOC detects the presence of hidden file inside /etc directory. Malware use this technique to hide their presence on the infected system. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1564.001. | linux |
SUSPICIOUS LATERAL MOVEMENT LINUX | This IOC detects lateral movement activity using server message block (SMB) and different utilities. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement, Defense Evasion, Persistence, Privilege and Technique(s): T1078, T1021.002, T1550.002. | linux |
SUSPICIOUS LOADING OF KERNEL MODULES | This IOC detects the usage of tools like kmod and insmod to insert a module into kernel, Attackers often use this technique for persistence and installing rootkits. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and echnique(s): T1547.006. | linux |
SUSPICIOUS LOGIN ATTEMPT TO DEFAULT ACCOUNTS | This IOC detects suspicious login attempt using pre-configured non-user accounts on a host. Such accounts are often used by installed services, but due to misconfiguration, allow remote access to the host. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation, Initial Access and Technique(s): T1078.001. | linux |
SUSPICIOUS LOGIN ATTEMPT TO DOMAIN ACCOUNTS | This IOC detects login attempt to domain accounts. This is associated with MITRE ATT&CK Technique(s): T1078.002. | linux |
SUSPICIOUS OPENSSL USAGE LINUX | This IOC detects the use of openssl utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1140, T1222.002, T1070.004, | linux |
SUSPICIOUS PACKAGE MANAGER INVOCATION | Attackers sometimes use yum to install packages stored locally. Kindly investigate the source of activity to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.006. | linux |
SUSPICIOUS PROCESS | This IOC detects the suspicious listing of details of all running process details. This is | linux |
SUSPICIOUS SHELL EXECUTION | This IOC looks for suspicious invocation of bash shell. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
SUSPICIOUS SHELL PROCESS (METHODOLOGY) | Adversaries may abuse shell commands and scripts for malware execution and post- infection activities. This IOC detects indicators associated with shell processes spawned by suspicious process. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | linux |
SUSPICIOUS SINGLE CHARACTER FILE NAMES | This IOC detects single character file names which are usually used by attackers to obscure the purpose of a binary. Kindly investigate the file to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | linux |
SUSPICIOUS SUDO OPERATIONS (METHODOLOGY) | This IOC detects various indicators associated with misuse of sudo for privilege escalation. This is associated with MITRE ATT&CK (r) Tactic(s): Privilege Escalation, Defense Evasion, | linux |
SUSPICIOUS USAGE OF TRUNCATE COMMAND (METHODOLOGY) | This IOC detects the suspicious usage of truncate command. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.002. | linux |
SYSTEM INFORMATION DISCOVERY (METHODOLOGY) | Attackers may discover various system information to guide them in the next phases of their attack. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and | linux |
SYSTEM USER DISCOVERY LINUX (METHODOLOGY) | This IOC detects an adversary attempting to use built in commands to identify users logged in on a host and get details of user activity. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1033, T1059.004. | linux |
SYSTEMD TIMERS (METHODOLOGY) | Systemd timers can be used by adversaries to establish persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.006. | linux |
TAMPERING BASH HISTORY A LINUX (METHODOLOGY) | The .bash_history file contains previously executed commands via the command-line after exiting the shell. Adversaries might clear the contents of the file as a method for hiding their tracks on a system. Adversaries may insert, delete, or manipulate the data in order to manipulate external outcomes or hide activity. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion, Impact, Collection, Credential Access and | linux |
TAMPERING BASH HISTORY LINUX (METHODOLOGY) | When commands are executed via the command-line, they are stored in the session's history. Running history command with -w writes the current history list in memory to the bash history file on disk. It does not append new entries but overwrites the complete file. Therefore running this command in conjunction with the clear command effectively clears the bash history file on disk as well. This is associated with MITRE ATT&CK (r) Tactic(s): | linux |
TAMPERING BASH LOGOUT LINUX (METHODOLOGY) | When a login shell exits, bash reads and executes commands from .bash_logout file. Adversaries may insert, delete, or manipulate the data in order to manipulate external outcomes or hide activity. This technique is generally used to clear the command history of the session. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion, Impact and Technique(s): T1059.004, T1070.003, T1565.001. | linux |
TAMPERING SUDOERS LINUX (METHODOLOGY) | Attackers often try to view the contents of /etc/sudoers file in search of bad configuration that can be abused to get privilege escalation or edit the contents of /etc/sudoers file to run programs with elevated permissions without password prompts. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): | linux |
TAMPERING WITH SSH FILES LINUX (METHODOLOGY) | Adversaries may modify SSH files directly with scripts or shell commands to add their own adversary-supplied public keys. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH. This IOC detects the operations like access, modification, etc. on such files. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Credential Access, Execution, Persistence and Technique(s): T1005, T1059.004, T1098.004, T1552.004. | linux |
TOUCH (UTILITY) | Touch is a linux utility that can be used to change the file timestamps, this is usually done by attackers as an anti-forensic technique. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.006. | linux |
TRAP (UTILITY) | Adversaries may use trap command to execute malware upon receiving a particular interrupt signal. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege | linux |
TRUNCATE (UTILITY) | TRUNCATE is a utility that allows to shrink or extend the size of a file to a given size. This is | linux |
USERADD LINUX (UTILITY) | Useradd is a utility for adding users or for updating default new user information. Attackers can use this to create new users with high privileges. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence and Technique(s): T1059.004, 1136.001. | linux |
VSFTPD COMMAND EXECUTION (METHODOLOGY) | This IOC detects execution of VSFTPD utility. It is the Very Secure File Transfer Protocol Daemon. This is associated with MITRE ATT&CK (r) Tactic(s): Exfiltration and Technique(s) : T1048.003. . | linux |
WEBSHELL ACTIVITY (METHODOLOGY) | This IOC detects suspicious commands being executed by possible web server accounts which can be indicative of webshell interaction. Kindly investigate the process that is being launched to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence and Technique(s): T1505.003. | linux |
WGET INSECURE EXECUTION LINUX (METHODOLOGY) | Wget is a tool to transfer data from or to a server, using various protocols. Although wget can be used for benign operations, source endpoints should be investigated if there is no authorized use of wget to work in insecure mode in the environment. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1059.004, T1564. | linux |
WGET SILENT EXECUTION LINUX (METHODOLOGY) | Wget is a tool to transfer data from or to a server, using various protocols. Although wget can be used for benign operations, source endpoints should be investigated if there is no authorized use of wget to work in silent mode in the environment. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1059.004, T1564. | linux |
ADMIN USER CREATION OSX (METHODOLOGY) | This IOC detects a threat actor attempting to create an account on a compromised host using dscl, the Directory Service command line utility tool. Threat actors will create local or domain accounts as a persistence mechanism. Adversaries commonly give these accounts access to remote access tools, such as VPN, to allow remote access to a network. Additionally, threat actors might also attempt to provide these accounts with elevated privileges to perform a variety of other commands on the compromised host. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution, Persistence and Technique(s): T1059.004, T1087.001, T1136.001. | osx |
APPLESCRIPT EXECUTION OSX (METHODOLOGY) | AppleScript is a scripting language developed by Apple as a means for automating tasks on a macOS device. Typically, these scripts serve to complete Administrative tasks, but adversaries can leverage the scripts to execute malicious code and even move laterally across a network. This IOC detects the usage of Script Editor to execute AppleScripts. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.002. | osx |
ARCHIVE WITH SSH FILES OSX (METHODOLOGY) | This IOC detects an adversary enumerating and gathering all ssh keys and files located on a compromised device. SSH keys consist of a public and private key that are used to authenticate with the SSH server. Adversaries can gather these keys and attempt to log in to the server to move laterally in a network. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1005, T1059.004. | osx |
AUTOMATIC LOGIN PASSWORD EXTRACTION OSX (METHODOLOGY) | This IOC detects the extraction of the plaintext password of any user on the Mac device with autologin enabled. Automatic login removes the need for a user to enter in their credentials after startup. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Discovery, Execution and Technique(s): T1003.008, T1059.004, T1087.001. | osx |
CHECK FOR AUTOMATIC LOGIN OSX (METHODOLOGY) | This IOC detects an adversary trying to check a compromised system for automatic login. Automatic login allows a user to bypass entering their credentials for login after booting up the machine. Instead, the device automatically boots to the desktop. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | osx |
DISABLED APPLICATION FIREWALL OSX (METHODOLOGY) | The firewall allows users to control what inbound connections are granted on the device. This IOC detects the disabling of the built-in application firewall on macOS endpoints. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, | osx |
DISABLED FIND MY MAC OSX (METHODOLOGY) | This IOC detects the modification of the plist file related to Find My Mac application, which contains the details of whether Find My Mac should be enabled on the machine or not. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Privilege Escalation and Technique(s): T1059.004, T1547.011, T1562.001. | osx |
DISABLED GATEKEEPER A OSX (METHODOLOGY) | Gatekeeper ensures that only trusted software from trusted sources executes on a Mac. Files downloaded from the Internet are placed in a quarantine area until it is confirmed by the user whether to proceed with the execution or not. This IOC detects disabling of Gatekeeper technology. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1059.004, T1553.001, T1562.001. | osx |
DISABLED GATEKEEPER OSX (METHODOLOGY) | Gatekeeper ensures that only trusted software from trusted sources executes on a Mac. Files downloaded from the Internet are placed in a quarantine area until it is confirmed by the user whether to proceed with the execution or not. This IOC detects disabling of Gatekeeper technology. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Privilege Escalation and Technique(s): T1059.004, T1547.011, T1553.001, T1562.001. | osx |
DISABLED MALWARE REMOVAL TOOL OSX | MRT, short for Malware Removal Tool, is part of Apple's security features which removes malware from the machine. MRT works alongside XProtect to remove any malware that XProtect discovers. This IOC detects the disabling of MRT on a macOS device. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): | osx |
DISABLED SYSTEM INTEGRITY PROTECTION OSX (METHODOLOGY) | This IOC detects an attempt to disable System Integrity Protection (SIP) on a macOS device. SIP is one of Apple's built-in security features on macOS devices, starting with OS X El Captain. SIP's goal is to protect specific files and folders on the device from being modified by malware. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1059.004, T1562.001. | osx |
DISABLED XPROTECT UPDATES OSX | XProtect is one of Apple's anti-malware protection methods and is part of the File Quarantine feature which quarantines and checks files downloaded from various sources on the Internet. This IOC detects the disabling of updates to XProtect on a macOS device. This IOC detects the modification of the plist file related to Find My Mac application, which contains the details of whether Find My Mac should be enabled on the machine or not. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Privilege Escalation and Technique(s): T1059.004, T1547.011, T1562.001. | osx |
EMAIL ADDRESS COLLECTION OSX | This IOC detects an adversary attempting to collect the email addresses stored within Apple's default email client, Mail. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1005, T1059.004, T1114.001. | osx |
ENABLE REMOTE DESKTOP OSX (METHODOLOGY) | This IOC detects when kickstart, a built-in command-line utility tool, is used to enable Apple Remote Desktop. Remote Desktop Sharing allows for Mac users to share their screen with other individuals and even let others control the device. While typically used for Administrative tasks, this can be leveraged for performing malicious activity. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.004, T1219. | osx |
ENUMERATION OF AIRPORT PREFERENCES OSX | This IOC detects the enumeration of the wireless preferences on a compromised machine. Property list files contain configuration settings and preferences for applications and other utilities on a Mac. These files are stored in either XML or binary form, both of which can be read using the built in utility tool plutil. This is associated with MITRE ATT&CK (r) Tactic(s): | osx |
ENUMERATION OF LOCAL ADMINS OSX (METHODOLOGY) | This IOC detects a threat actor trying to enumerate users of the local Admin group on a compromised machine using dscl, the built in directory service command line utility tool. Adversaries seek to identify and access user accounts and permission groups that have the highest levels of access to an environment or access to high value systems and data. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1059.004, T1069.001, T1087.001. | osx |
ENUMERATION OF PATHS PROTECTED BY SIP OSX (METHODOLOGY) | This IOC detects the enumeration of all directory paths protected by System Integrity Protection (SIP) on macOS devices. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1059.004, T1083. | osx |
ENUMERATION OF SSH FILES OSX (METHODOLOGY) | This IOC detects an adversary enumerating all ssh keys and files located on a compromised device. SSH keys consist of a public and private key that are used to authenticate with the SSH server. Adversaries can gather these keys and attempt to log in to the server to move laterally in a network. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1005, T1059.004. | osx |
ENUMERATION OF SYSTEM INFORMATION OSX (METHODOLOGY) | Various native built-in commands can be executed to pull back a variety of information including software version, firewall settings, and network connections. This IOC detects the gathering of basic system information from a macOS machine. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1016, T1033, T1049, T1059.004, T1082, T1087.001, T1087.002. | osx |
ENUMERATION OF WIRELESS NETWORKS OSX (METHODOLOGY) | This IOC detects the enumeration of available wireless networks on a macOS device to extract the name, security settings, and other related information. This is associated with- MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1016, T1059.004. | osx |
EXFILTRATION OF SSH FILES OSX (METHODOLOGY) | This IOC detects exfiltration of ssh keys and files located on a compromised device. SSH keys consist of a public and private key that are used to authenticate with the SSH server. Adversaries can gather these keys and attempt to log in to the server to move laterally in a network. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1005, T1059.004. | osx |
GETSHELL VARIANT (BACKDOOR) | This is a methodology IOC to search for a new variant of the OS X Getshell backdoor. Tested samples provided a reverse shell to destination port 4444. | osx |
HIDDEN USER CREATION OSX (METHODOLOGY) | Adversaries can create local or domain accounts as a persistence mechanism. As a way to avoid detection, threat actors can also hide these accounts so that they do not appear at the login screen. This IOC detects a threat actor attempting to create a hidden user account on a Mac in a compromised environment. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence and Technique(s): T1059.004, T1136.001, T1564.002. | osx |
hosts file modified (OSX) | Detects modification of the "hosts" file. The host file is often use to sinkhole network communications for security products. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | osx |
KEYCHAIN COLLECTION OSX (METHODOLOGY) | This IOC detects the enumeration and collection of keychains on a compromised Mac. Mac devices use keychains as its built-in method for maintaining credentials for users and other services on the device. To access these keychains, a person must have the master login keychain password. If a person has not changed their keychain password, it will be the same as the credentials they use to log into the device. If an adversary obtained access to the keychain password, they could then access all of the other credentials stored in the keychain. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Credential Access, Execution and Technique(s): T1005, T1059.004, T1555.001. | osx |
LOCAL USER GROUP DISCOVERY OSX | This IOC detects a threat actor attempting to discover groups on a compromised Mac host by using the dscacheutil command line utility tool. Groups provide a means for managing multiple users with the same level of privileges. Adversaries can use this information to determine which groups and accounts to target to acquire elevated privileges. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1059.004, T1069.001. | osx |
MESSAGES COLLECTION OSX (METHODOLOGY) | This IOC detects an adversary attempting to gather additional information on a compromised Mac via Messages. Messages allow Mac users to send iMessages from their computer to any other system that uses iMessage. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1005, T1059.004. | osx |
MODIFICATION OF BASH PROFILE OSX | When a user logs into the system, .bash_profile is executed after credentials are entered in successfully. If the full file path to a script is added to this file, that script will be executed as well. Adversaries can reference malicious scripts in .bash_profile as a technique for maintaining persistence on the machine. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1059.004, T1546.004. | osx |
MODIFICATION OF BASHRC FILE OSX (METHODOLOGY) | When a user spawns a new interactive, non-login shell, then .bashrc file is executed. If the full file path to a script is added to this file, that script will be executed as well. Adversaries can reference malicious scripts in .bashrc as a technique for maintaining persistence on the machine. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1059.004, T1546.004. | osx |
MODIFICATION OF SUDOERS FILE (METHODOLOGY) | The /etc/sudoers file contains the users that have SUDO elevated permissions. Any modifications to this file should be validated as attackers can add their current user to this file to maintain elevated privileges to a compromised system. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Privilege Escalation, Defense Evasion and Technique(s): T1059.004, T1548.003. | osx |
MODIFICATION OF SUDOERS FILE A OSX (METHODOLOGY) | This IOC detects a privilege escalation technique which is achieved by making edits to the sudoers file. The /etc/sudoers file contains the users that have SUDO elevated permissions. This specific file provides information on who can run specific commands as well as who can run commands as another user or group. Adversaries can use this technique to their advantage to run commands or processes at a higher privilege. Any modifications to this file should be validated as attackers can add their current user to this file to maintain elevated privileges to a compromised system. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Privilege Escalation and Technique(s): T1059.004, T1548.003. | osx |
MOKES (FAMILY) | MOKES is a cross-platform backdoor capable of functioning on all major operating systems. It can steal data, execute arbitrary commands, and communicate using encrypted C2 channels. | osx |
NETCAT BIND SHELL OSX (METHODOLOGY) | This IOC detects the abuse of netcat to create a bind shell using the listener flag on a specific port. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | osx |
OFFICE APPLICATION SHELL EXECUTION (METHODOLOGY) | This alert looks for Office applications launching shell processes. The arguments of these processes should be analyzed to determine if the activity is malicious. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.003. | osx |
OSASCRIPT EXECUTION OSX (METHODOLOGY) | AppleScript is a scripting language developed by Apple as a means for automating tasks on a macOS device. Typically, these scripts serve to complete Administrative tasks, but adversaries can leverage the scripts to execute malicious code and even move laterally across a network. AppleScripts can be executed by using the osascript utility. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.002, T1059.004. | osx |
PASSWORD POLICY DISCOVERY OSX | This IOC detects an adversary trying to discover the password policy on a macOS device. Adversaries can use this information to their advantage to set up their password lists to contain passwords that fulfill all of the requirements outlined in the policy. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1059.004, T1201. | osx |
PHISHING WITH APPLESCRIPT OSX | Attackers can leverage AppleScript to create a fake password prompt on a compromised host as a method for collecting credentials. If a user falls for the technique and enters in their password, the password is returned to the shell that initially executed the script. Similar legitimate prompts appear when an executed program requires additional privileges to perform its tasks. Adversaries can easily mimic this activity by creating a simple AppleScript to collect other credentials to use at a later time. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Credential Access, Execution, Lateral Movement and Technique(s): T1056.002, T1059.002, T1059.004, T1534. | osx |
PLIST DISGUISED AS SYSTEM LAUNCHAGENT | LaunchAgents on macOS are .plist files in which the services and components to be run are stored.The preference files generally follow the standard reverse domain naming system. Malware authors, in an attempt to avoid suspicion, name the plist files as com.apple. Genuine com.apple files exist in System folder but not in user folders. Investigate the files identified by this IOC to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1036.005, T1543.001, T1547.011. | osx |
POTENTIAL BASH REVERSE SHELL OSX (METHODOLOGY) | This IOC detects the reverse shell written in bash commands. Kindly investigate the source of the activity to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004. | osx |
SAFARI PLIST ACCESS (METHODOLOGY) | This IOC detects safari protected folder access using plutil. This folder contains useful information on user browsing history. This is associated with MITRE ATT&CK (r) Tactic(s): Collection,Defense Evasion, Persistence, Privilege Escalation, Initial Access and Technique(s): T1114,T1078. | osx |
SCRIPT APP EXECUTION OSX (METHODOLOGY) | AppleScript is a scripting language developed by Apple as a means for automating tasks on a macOS device. Typically, these scripts serve to complete Administrative tasks, but adversaries can leverage the scripts to execute malicious code and even move laterally across a network. Apple's Script Editor can be used to create an app with an embedded script. This IOC detects the execution of such Script applications, commonly known as applets. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.002. | osx |
SECURITY TOOLS DISCOVERY (METHODOLOGY) | This IOC detects discovery of a system for known security software. Attacker may use this information to decide about further infection chain. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1518.001,T1518. | osx |
SSH KEY PERSISTENCE (METHODOLOGY) | This alert looks for the manual addition of SSH keys into the authorized_keys file. This has been used by attackers to maintain SSH access to a compromised system. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence and Technique(s): T1098.004 | osx |
SUSPICIOUS LAUNCHAGENT (METHODOLOGY) | LaunchAgents on macOS are .plist files in which the services and components to be run are stored.The preference files generally follow the standard reverse domain naming system. It begins with the company name, followed by an application identifier, and ends with the property list file extension. The launchagents generated by malware do not follow this naming system most of the time. Investigate the files identified by this IOC to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.001, T1547.011. | osx |
SUSPICIOUS LAUNCHCTL USAGE OSX | Launchctl interacts directly with launchd to load and unload daemons and agents on macOS devices. These daemons and agents each have a property list file which contains configuration and properties about each process. Adversaries can take advantage of property list keys and values to execute malicious scripts on a compromised device. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.004, T1569.001. | osx |
SUSPICIOUS OPENSSL | This IOC detects the use of openssl utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1140, T1222.002, T1070.004, T1059.004, T1132.001. | osx |
SUSPICIOUS SCREENCAPTURE OSX (METHODOLOGY) | On OSX, the native command screencapture can be used to capture images from the screen and save them to a file. These files are saved to /tmp/ directory by some malware to avoid suspicion, which are later exfiltrated. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Execution and Technique(s): T1059.004, T1113. | osx |
USER ACCOUNT ENUMERATION A OSX (METHODOLOGY) | This IOC detects the usage of dscl command to extract all local user accounts on the system. Dscl, the "Directory Service command line utility", allows a user to read, write, and manage Directory Service data on the local system directory. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1033, T1059.004, T1087.001. | osx |
USER ACCOUNT ENUMERATION B OSX (METHODOLOGY) | This IOC detects the usage of plutil command to extract specific user information on a compromised machine. Plutil, the "property list utility", allows a user to read and write property list files. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1033, T1059.004, T1087.001. | osx |
USER ACCOUNT ENUMERATION OSX (METHODOLOGY) | This IOC detects the usage of dscacheutil command to extract all local system accounts. Dscacheutil, the "Directory Service Cache" utility, allows a user to gather statistics, initiate lookups, inspection, cache flush, among other tasks on the local system. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1033, T1059.004, T1087.001. | osx |
7-zip archive created | Detects creation of 7-zip archive, based on file signature. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1074.001, T1560. | win |
7zip execution | Detects the execution of the 7-zip utility, based on file name. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1074.001, T1560. | win |
Accessibility features child process (METHODOLOGY) | Detects child processes of common Windows accessibility features, which may indicate a "stickykeys"-type accessibility features replacement attack. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.008. | win |
Accessibility features file write | Detects writes to Windows accessibility files, which may indicate an attack. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.008. | win |
ACCOUNT ACTIVATION USING NET UTILITY | This IOC detects an attempt to activate an inactive account such as Guest or Administrator using net utility. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence and Technique(s): T1136.001. | win |
ADFIND (UTILITY) | Attackers may use AdFind tool to do Active Directory reconnaissance. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1087.002, T1482, T1069.002, T1018, T1016. | win |
ADIDNSDUMP (UTILITY) | ADIDNSDUMP is a tool that enables enumeration and exporting of all DNS records. This IOC detects activity coming from ADIDNSDUMP. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
ADS Code Exec (Methodology) | Identifies code execution from alternate data streams, including using wmic to run EXEs, rundll32 to run DLLs, script hosts loading script code, regsvr32.exe loading scriptlet, mshta.exe loading HTAs. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1564.004. | win |
ADS ESC8(METHODOLOGY) | AD CS is a server role that functions as Microsoft public key infrastructure (PKI) implementation but ADCS web enrollments endpoints are vulnerable to NTLM relay attacks.Using NTLM relay, an attacker can impersonate an inbound-NTLM-authenticating victim user accessing the web interfaces and can request a client authentication certificate.This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Collection and Technique(s): T1557.001. | win |
ADS Process Activity | Looks for activity by processes running from NTFS Alternate Data Streams (ADS). This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1564.004. | win |
ADSLDP.DLL LOAD (METHODOLOGY) | This looks for any process loading ADSLP.dll which can be indicative of AD reconaissance. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
APACHE STRUTS 2 RCE CVE- 2017-5638 (EXPLOIT) | CVE-2017-5638 can enable remote code execution on a server running a vulnerable version of Apache Struts. The vulnerability exists in the Jakarta Multipart parser due to improper handling of the Content-Type header. An attacker can use malicious OGNL in Content-Type header to trigger this vulnerability, and then execute the system command leading to RCE. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access and Technique(s): T1190. | win |
APLIB (UTILITY) | aPLib is a compression utility that can be used by attackers to compress collected data prior to exfiltration. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1560.001. | win |
Arp execution | Detects execution of the Windows arp command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
ATTRIB COMMAND EXECUTION | This IOC detects execution of attrib command. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1564.001. | win |
Automated Collection | Identifies possible output files from CMD commands. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1119. | win |
AUTORUN.INF FILE CREATION (METHODOLOGY) | This IOC looks for any process writing to autorun.inf in a root directory. This is used by various malware to infect air gapped machines. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1092. | win |
BAT script execution | Identifies Window batch script (BAT) execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.003. | win |
BCDEDIT CHANGE SAFEBOOT OPTIONS (METHODOLOGY) | This IOC detects the modification of safeboot value using bcdedit utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
BCDEDIT RECOVERY VALUE CHANGE (METHODOLOGY) | This IOC detects the modification of recoveryenabled value which will prevent the system from being able to boot into the Windows Recovery. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1490. | win |
BCDEDIT USAGE (UTILITY) | BCDEDIT is a command-line tool that can be used by attackers for managing the Boot Configuration Data (BCD). This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1490. | win |
Bitsadmin Execution | Identifies execution of the Windows Bitsadmin utility. This is associated with MITRE | win |
CAB File Creation | Identifies creation of Microsoft Cabinet (CAB) files by extension. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Defense Evasion and Technique(s): T1074.001, T1140, T1560. | win |
CAB File Masquerade | Identifies Microsoft Cabinet (CAB) files by content, where the extension is not .cab. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Defense Evasion and Technique(s): T1036.005, T1074.001, T1140, T1560. | win |
CARBANAK CONFIG FILE (BACKDOOR) | This alert looks for a config file created when the CARBANAK backdoor is successfully installed. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
CARBANAK TAKEOUT (BACKDOOR) | TAKEOUT is a PowerShell loader that contains base64 encoded and compressed data which is a PE file that is loaded into memory and executed. It has been observed loading at least two malware families related to FIN7. This alert looks for the creation of both the initial encoded PowerShell script and the second stage deobfuscated PowerShell script in %AppData%. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion and Technique(s): T1059.001, T1140. | win |
Certutil Decode | Identifies use of certutil to decode file content. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1140. | win |
CERTUTIL DECODE B (METHODOLOGY) | Certutil.exe is a native Windows binary that is part of the built-in Certificate Services. It has been used by attackers to natively encoded/decode base64 data. This alert also looks for certutil.exe -decode or -decodehex arguments in process and registry events used to decode encoded payloads often stored in fake certificate formats. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1140. | win |
Certutil execution | Detects execution of the Windows utility certutil, which is often used by attackers to encode/decode data, and to surreptitiously download data. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion and Technique(s): T1105, T1140, T1553.004. | win |
Certutil File Write | Identifies file written by the Windows certutil.exe utility, which may be used to decode files or data. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion and Technique(s): T1105, T1140, T1553.004. | win |
CHROME PASSWORD STEALING | This IOC looks for Login Data and Web Data files being created by non-chrome processes, these are files where chrome stores saved logins and saved credit card info; attackers sometimes creates copies of these files for exfiltration or offline decryption. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1555.003. | win |
CLR IN SEARCHPROTOCOLHOST | This IOC looks for indicators of .NET code loaded in searchprotocolhost.exe, this could be an indication of searchprotocolhost.exe being used for injection purposes. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1055. | win |
CLR IN WERFAULT (METHODOLOGY) | This IOC looks for indicators of .NET code loaded in werfault.exe, this could be an indication of werfault,exe being used for injection purposes. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1055. | win |
CMD Child Process | Identifies processes spawned by cmd.exe, indicating usage of the command line interface. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.003. | win |
CMD Execution | Identified execution of the Windows command line interface, cmd.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.003. | win |
CMD file write | Detects files written by the Windows command-line processor, cmd.exe. This may identify copied files or output files. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.003, T1105. | win |
CMD NETWORK CONNECTION | Detects network connections from the CMD process. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.003, T1071.001, T1105. | win |
CMD script execution | Identifies CMD script execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.003. | win |
CMD URL REQUEST | Detects URL requests from CMD. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.003, T1071.001, T1105. | win |
COM CLSID registry activity (METHODOLOGY) | Detects changes to Windows Component Object Model Class ID (clsid) registry persistence keys. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1112, T1546.015. | win |
COM Hijacking | Identifies COM hijacking by writing to HKCU or HKU registry hives. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1112, T1546.015. | win |
COM Object Change | Identifies changes to HKLM COM objects. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1112, T1546.015. | win |
COMMANDLINE CHECKING CAPABLITY SID (METHODOLOGY) | All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'.Attackers may leverage the registry key to extract some useful information from the system, granting a Windows component, access to varioous resources or delete some known SID's for its advantage.This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1134.005. | win |
Comspec Registry (METHODOLOGY) | Detects the Windows environment variable %comspec% in Windows registry persistence locations. This may be indicative of malicious lateral movement or persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Privilege Escalation and Technique(s): T1059.003, T1112, T1543.003, T1547.001, T1569.002. | win |
CONTROL PANEL ITEMS (METHODOLOGY) | Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.002. | win |
CONTROL PANEL ITEMS A (METHODOLOGY) | Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.002. | win |
Copy/Move command | Detects copy commands based on process arguments. Will not detect copy commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Command And Control and Technique(s): T1074.001, T1105. | win |
CREATING SHORTCUT VIA COMMANDLINE (METHODOLOGY) | This IOC detects the creation of the shortcut file via Windows commandline to the target path in the 'Start Menu\Programs\Startup' directory. Attackers can use this technique to attain persistence causing the program to execute when a user logs in.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.001, T1547.002. | win |
Credential Search | Identifies searching for credentials based on process arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1552.001. | win |
CSC.EXE EXECUTION (METHODOLOGY) | This IOC detects the execution of C# compiler csc.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1027.004. | win |
Cscript execution | Detects execution of the Windows script host. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.005, T1059.007. | win |
Cscript/Wscript Child Process | Identifies processes spawned by cscript and wscript. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.005, T1059.007. | win |
CSVDE EXECUTION (METHODOLOGY) | csvde.exe is a tool that can be used to import and export data from Active Directory Domain Services (AD DS). This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1069.002, T1087.002. | win |
CURL EXECUTION (METHODOLOGY) | This IOC detects execution of cURL utility. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071.001. | win |
DATA COMPRESSION USING POWERSHELL (METHODOLOGY) | Detects use of PowerShell cmdlet to archive from specified files and directories. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1560. | win |
Data staging | Identifies file writes to locations that may be used by attackers for staging data. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1047. | win |
DCOM RPC traffic | Detects Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) traffic based on network port. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Lateral Movement and Technique(s): T1021.003, T1559.001. | win |
DEFAULT NETWORK SHARES (METHODOLOGY) | Adversaries often use network shares for lateral movement. This is a low fidelity IOC to check for presence of files and execution of files from default network shares like admin$, c$, ipc$. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.002, T1570. | win |
Del command | Detects Windows delete commands based on process arguments. Will not detect delete commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.004. | win |
DESKTOPIMGDOWNLDR (UTILITY) | DesktopImgDownldr is a benign windows binary that can be abused by adversaries to download payloads. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Execution and Technique(s): T1197, T1559.001. | win |
Dir Command Output | File containing output from the "dir" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1083. | win |
Directory listing command | Detects Windows directory listing commands based on process arguments. Will not detect commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1047, T1059.001, T1059.003, T1083. | win |
DISABLING WINDOWS IIS HTTP LOGGING (METHODOLOGY) | Detects suspicious disabling of Windows IIS HTTP Logging via AppCmd.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.002. | win |
DLL SEARCH ORDER HIJACKING (METHODOLOGY) | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. We must enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions.However attackers may try to disable the associated registry key to exploit the technique.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation, Defense Evasion and Technique(s): T1574.001. | win |
DLL SEARCH ORDER HIJACKING BY FIN7 | This IOC detects known DLLs observed in FIN7 attack which got loaded via Dll Search Order Hijacking technique. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation, Defense Evasion and Technique(s): T1574.001 | win |
DOMAIN SYSTEMS IDENTIFICATION WITH NET.EXE (METHODOLOGY) | This IOC detects the use of net.exe utility to identify remote systems within a domain group. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
DRIVERQUERY USAGE (UTILITY) | DriverQuery is a utility that can be used to display a list of installed device drivers and their properties. This is associated with MITRE ATT&CK (r) Tactic(s): Reconnaissance and Technique(s): T1592.001. | win |
Dsquery execution | Detects execution of the Windows dsquery utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1069.002, T1087.002, T1018. | win |
Echo command execution | Detects Windows "echo" commands based on process arguments. Will not detect echo commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1087.001. | win |
ECHO TO NAMED PIPE (METHODOLOGY) | Adversaries may used named pipes for communication. This is associated with MITRE ATT&CK (r) Tactic(s): Command and Control and Technique(s): T1105, T1090.001. | win |
Email collection | Identifies email enumeration and aggregation. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1114.001. | win |
EMAIL SPEARPHISHING (METHODOLOGY) | This IOC detects execution of malicious files attached in the Email. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access, Execution and Technique(s): T1566.001, T1204.002 | win |
Empire SessionGopher | Identifies "invoke-sessiongopher" in process arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1552.004. | win |
ENABLING RDP (METHODOLOGY) | Adversaries may enable remote desktop connections to login interactively. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement and Technique(s): T1562.001, T1021.001. | win |
Encoded Clipboard | Identifies the word "clipboard" base64 encoded. This may be indicative of attempts to read the system clipboard. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Command And Control and Technique(s): T1115, T1132.001. | win |
Encoded VBScript File Created | Detects the creation of encoded VBScript files (VBE) by looking for the VBE magic header bytes (23 40 7E 5E). Files in this format may be used to obfuscate malicious VB scripts run via scripting interpreters such wscript and cscript. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1027, T1059.005. | win |
Encrypted 7zip Archive Command | Identifies commands to create encrypted 7zip archives. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1074.001, T1560. | win |
Encrypted RAR archive command | Detects possible encrypted WinRAR archive creation based on process arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1074.001, T1560. | win |
ENUMERATE LOCAL USER ACCOUNTS VIA WMIC (METHODLOGY) | This IOC detects the execution of a wmic command to list all local user accounts within a given system. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1047. | win |
ENUMERATING DOMAIN TRUSTS (METHODOLOGY) | This IOC detects the attempt to gather information on domain trust relationships. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1482. | win |
eventvwr process creation (METHODOLOGY) | Detects processes created by the Windows event log viewer, which may indicate the use a of User Account Control (UAC) bypass. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1548.002. | win |
EVIL-WINRM (UTILITY) | Detects use of Evil-WinRM utility. Evil-WinRM is Windows Remote Management utility used by adversaries. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.006. | win |
EXECUTABLE DISGUISED AS INF FILE (METHODOLOGY) | This IOC detects suspicious INF file which has executable file header. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.003. | win |
Execution from suspicious directory | Detects processes running from uncommon locations. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | win |
Execution from temp directory | Detects processes executing from Windows or user "temp" directories. These processes may warrant additional attention. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | win |
Execution From User Directory | Identifies execution from user directories. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1204.002. | win |
Expand Execution | Identifies execution of the Windows expand.exe utility. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion and Technique(s): T1105, T1140, T1564.004. | win |
EXTRACTING SYSTEMINFO VIA REGISTRY (METHODOLOGY) | An adversary may attempt to get detailed information about the operating system as they can query the HKLM\SYSTEM\CurrentControlSet\Services registry tree which stores information about each service on the system.This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
FILE EXTENSION MASQUERADING (METHODOLOGY) | This IOC detects file extension masquerading. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.003. | win |
File Name Masquerade | Identifies files named to trick users about their type. This is frequently used in user execution attacks. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1036, T1204.002. | win |
File Transfer Utility Execution | Identifies use of file transfer utilities. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
File Transferred Over SMB | Identifies files transferred to the system using SMB. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Lateral Movement and Technique(s): T1021.002, T1105. | win |
File write to named pipe | This IOC detects communications using named pipes to remote systems. Does not capture named pipe activity on the local system. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071.002, T1105. | win |
File write to network share | Captures files written to remote network shares. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Lateral Movement and Technique(s): T1105, T1570. | win |
File write to root of recycle bin | Detects files written to the root of the recycle bin. All legitimate files should be written to a subfolder of the recycle bin. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | win |
FILE WRITE TO TEMP DIRECTORY (METHODOLOGY) | This IOC looks for explorer creating files in Temp folder. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
FILE WRITE TO WEBROOT DIRECTORIES (METHODOLOGY) | This IOC loosely maps to Shared Webroot technique since it only looks for PHP file writes in default web root directories of popular windows web servers and does not guarantee that the file write is from a remote system using a shared web root. | win |
Findstr execution | Detects execution of the Windows "findstr" find string utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1083. | win |
FIREEYE ENDPOINT AGENT SERVICE DISABLE (METHODOLOGY) | IOC detects disabling of FireEye Endpoint Agent service. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
FIREFOX PASSWORD STEALING | This IOC looks for non-firefox processes loading the nss3.dll. This dll is loaded by password stealers to use apis exported by it to parse credentials in the file logins.json. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1555.003. | win |
Fltmc execution | Detects execution of the Windows minifilter driver management utility, which can be used to list, load and unload minifilter drivers. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery and Technique(s): T1518.001, T1562.001. | win |
FSUTIL USAGE (METHODOLOGY) | This IOC detects the suspicious usage of FSUTIL utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1120. | win |
FTP network connection | Detects FTP connections based on common network ports. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Credential Access, Discovery, Exfiltration and Technique(s): T1020, T1048.003, T1071.002, T1083, T1110.001. | win |
FTP utility execution | Detects execution of the Windows FTP utility, based on process name. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion, Exfiltration and Technique(s): T1048.003, T1105, T1202. | win |
Getmac Execution | Identifies execution of the Windows getmac.exe utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
GET-SMBSHARE POWERSHELL COMMAND USAGE (METHODOLOGY) | Get-SmbShare powershell cmdlet retrieves objects that represent the Server Message Block (SMB) shares being displayed by the computer. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1135. | win |
GOOGLE CHROME BOOKMARK ENUMERATION USING TYPE UTILITY (METHODOLOGY) | This IOC detects the possible enumeration of Google Chrome bookmarks using type utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1217. | win |
GPRESULT (UTILITY) | Detects use of gpresult command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1069.001. | win |
Group Enumerations | Identifies PowerShell Get-ADGroup and Get-ADGroupMember commands and WMI Win32_Group and Win32_GroupUser queries. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1047, T1059.001, T1069.002. | win |
GROUP POLICY METHODOLOGY (METHODOLOGY) | Group policy allows for centralized management of user and computer settings in Active Directory (AD). Attackers uses the GPO modification to implement schedule tasks, disable security tools, sewrvice execution, etc. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1484. | win |
GROUP POLICY MODIFICATION (METHODOLOGY) | This IOC detects the group policy modification. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1484.001. | win |
GSECDUMP (CREDENTIAL STEALER) | Gsecdump is a publicly-available tool used within a command-line interface to dump the Windows SAM database, cached domain credentials, LSA details and active logon sessions.This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access,Defense Evasion, Persistence, Privilege Escalation, Initial Access and Technique(s): T1003.002, T1003.004, T1078. | win |
HIDING DESKTOP ICONS THROUGH REGISTRY (METHODOLOGY) | This IOC detects the suspicious commandline to hide or modify the desktop icons via the registry which can be used by attackers to simulate shortcut modification.This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.009. | win |
HIGHEST PRIVILEGE SCHTASKS EXECUTION (METHODOLOGY) | This IOC detects scheduled tasks being set to use highest privileges using schtasks. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.005. | win |
Host File Access | Identifies references to the Windows hosts file (%systemroot%\system32\Drivers\etc\hosts). This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
Hostname Execution | Identifies execution of the Windows hostname.exe utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
hosts file modified (windows) | Detects modification of the "hosts" file. The host file is often use to sinkhole network communications for security products. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
Icacls execution | Detects execution of the Windows icacls utility, which can be used to display or change Windows security descriptors. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.004, T1222.001. | win |
IDENTIFYING WINDOWS GUID VIA REGISTRY (METHODOLOGY) | This IOC detects the command to identify the Windows MachineGUID value for a system by the attackers. Upon execution, the machine GUID will be displayed from registry which is a unique identifier for a machine.This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
INDICATOR BLOCKING (METHODOLOGY) | Attacker can block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting or even disabling host-based sensors, such as Event Tracing for Windows (ETW),by tampering settings that control the collection and flow of event telemetry. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.006. | win |
INDIRECT COMMAND EXECUTION (METHODOLOGY) | This IOC detects execution of the Windows utilities such as forfiles and pcalua, which can be used for obfuscation and to break up parent/child process relationships. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Defense Evasion and Technique(s): T1202, T1083. | win |
INSTALLED SOFTWARE ENUMERATION (METHODOLOGY) | This IOC detects execution of a WMIC command that provides a list of installed applications on a given host. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1047, T1518.001. | win |
INTERACTIVE MALICIOUS POWERSHELL B (METHODOLOGY) | This IOC looks for interactive (hands on keyboard) use of known bad PowerShell functions and suspicious command combinations.This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion and Technique(s): T1059.001, T1207, T1484. | win |
INTERCEPTER EXECUTION | Intercepter is a console program that can be used to sniff network traffic. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Discovery and Technique(s): T1040. | win |
INTERCEPTER NG (UTILITY) | Intercepter NG is an utility which is used to perform man-in-the-middle attacks. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Discovery and Technique(s): T1040. | win |
INVOKE-WEB REQUEST COMMANDLINE (METHODOLOGY) | The Invoke-WebRequest cmdlet sends HTTP and HTTPS requests to a web page or web service. It parses the response and returns collections of links, images, and other significant HTML elements.This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1204.002, T1059.001. | win |
Ipconfig command output | Detects output of the "ipconfig" utility being written to disk. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
Ipconfig execution | Detects execution of the Windows ipconfig utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
IWBEMSERVICES USAGE (METHODOLOGY) | This IOC detects usage of IWbemServices interface to access WMI services. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1047. | win |
JAVA ARCHIVE FILE MASQUERADING AS INSTALLER PACKAGE FILE (EXPLOIT) | This IOC detects suspicious MSI file with a JAR data appended to the end. Such files can be used to exploit CVE-2020-1464 to bypass digital signature verification on windows. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1211, T1553.002. | win |
JOURNAL DELETION VIA FSUTIL (METHODOLOGY) | This IOC detects deletion of active USN change journal using fsutil utility.This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070. | win |
Kerberos Network Connection | Identifies Kerberos network connections based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Defense Evasion, Lateral Movement and Technique(s): T1110.003, T1212, T1550.003, T1558.003. | win |
Kerberos Ticket Creation | Identifies dumped kerberos tickets by extension. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Defense Evasion, Lateral Movement and Technique(s): T1550.003, T1558.003. | win |
KERBEROS TICKET FILE CREATION (METHODOLOGY) | This alert looks for Kerberos ticket contents written to disk. Some attackers have written Kerberos ticket information to disk as file names like 1.krb, 2.krb, etc. This alert focuses on the file header contents and a valid size range for Kerberos ticket information. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Defense Evasion, Lateral Movement and Technique(s): T1550.003, T1558.003. | win |
LAUNCHING MICROSOFT EDGE (METHODOLOGY) | This IOC detects launnching of microsoft edge via commandline.This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1569.002. | win |
Lazagne password stealer (Credential Stealer) | Detects execution of the Lazagne password stealer and Lazagne output being written to disk. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1552.001, T1555.003. | win |
LDAP Network Connection | Identifies Lightweight Directory Access Protocol (LDAP) network connections based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1110.002. | win |
LISTING APPLICATIONS INSTALLED (METHODOLOGY) | This IOC detects registry being queried to determine software and versions installed on the system. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
LISTING OF BROWSER BOOKMARKS (METHODOLOGY) | This IOC detects listing of browser bookmark files. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1217. | win |
LOCAL PROXY MODIFICATION (METHODOLOGY) | This IOC detects local proxy modification via windows registry. Attacker can modify the local proxy settings to maliciously tunnel their internet communication. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1112. | win |
Local System Data | Identifies enumeration and aggregation commands associated with data theft from the local system. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1005, T1119. | win |
LOCKY RANSOMWARE (FAMILY) | Locky is ransomware. The main infection method is a Microsoft Word document with a malicious macro that is delivered as an email attachment. The macro runs a script to download and run Locky on the victim host. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1486. | win |
LOLbin execution | Detects execution of numerous "living off the land" binaries - signed binaries used to launch arbitrary code, to bypass detection, application whitelisting and/or User Account Control. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1216.001, T1218.001, T1218.002, T1218.003, T1218.004, T1218.005, T1218.007, T1218.008, T1218.009, T1218.010, T1218.011, T1548.002,T1127.001. | win |
lsremora.dll import (CREDENTIAL STEALER) | DLL used by Pwdump password stealer. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003.005. | win |
Makecab Execution | Identifies execution of the Windows makecab.exe utility, used to create Cabinet (CAB) archives. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1074.001, T1560. | win |
MASQUERADING ACTIVITY BY FIN7 | This IOC detects known service and schedule task created in FIN7 attack. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.004 | win |
MESSAGE (UTILITY) | This IOC detects usage of msg utility. This utility is used to send a message to a user on Remote Desktop. A well-known threat actor Emotet seems to use this tool for displaying a fake message.This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Initial Access and Technique(s): T1204,T1566.001,T1059. | win |
Mimikatz Crypto Extract | Identifies Mimikatz crypto::extract commands. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1552.004. | win |
Mimikatz Execution (CREDENTIAL STEALER) | Looks for command-line arguments and file contents associated with the Mimikatz credential-stealing and post-exploitation utility. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003.001, T1003.002, T1003.004. | win |
Mimikatz Pass-The-Ticket | Identifies Mimikatz pass-the-ticket kerberos attacks by arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement and Technique(s): T1550.003. | win |
MININT REGISTRY KEY CREATION (METHODOLOGY) | This IOC detects creation of MiniNT registry key which would stop Windows from logging security events. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1112. | win |
MMC Account Access | Identifies use of the Microsoft Management Console (mmc.exe) with the lusrmgr.msc snap- in to enumerate, create or modify user accounts in the Windows GUI. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Persistence and Technique(s): T1087.001, T1136.001. | win |
MMC Scheduled Task | Identifies use of the Microsoft Management Console (mmc.exe) with the taskschd.msc snap-in to enumerate, create or modify scheduled tasks. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.005. | win |
mmc.exe DCOM activity | Identifies Distributed Component Object Model (DCOM) MMC20 process execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Lateral Movement and Technique(s): T1021.003, T1559.001. | win |
Mofcomp Execution | Identifies execution of the Windows Managed Object Format (MOF) compiler mofcomp.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1047, T1546.003. | win |
MSSQL Network Connection | Identifies Microsoft SQL database network connections based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Impact and Technique(s): T1110.002, T1489. | win |
MySQL Network Connection | Identifies network connections to MySQL databases based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Impact, Lateral Movement and Technique(s): T1110.002, T1210, T1489. | win |
Nbtscan Execution | Identifies execution of the nbtscan utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
Nbtstat execution | Detects execution of the Windows nbtstat utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
Net accounts command execution | Detect execution of the "net accounts" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1201. | win |
NET COMPUTER COMMAND EXECUTION (METHODOLOGY) | This IOC detects the execution of net computer command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1135. | win |
Net config command execution | Detects execution of the "net config" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016, T1033, T1082. | win |
Net group command execution | Detects execution of the "net group" and "net localgroup" commands. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1069.002. | win |
NET SERVICE STOP COMMAND EXECUTION (METHODOLOGY) | This IOC detects execution of the "net stop" command. This is associated with MITRE ATT&CK (r) Tactic(s): Impact, Execution, Defense Evasion and Technique(s): T1489, T1569.002, T1562.001. | win |
Net session command execution | Detects execution of the "net session" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1049. | win |
Net Share Command Execution | Identifies net share commands, used to list network shares. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018, T1135. | win |
Net start command execution | Detects execution of the "net start" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1007, T1569.002. | win |
Net use command execution | Detects execution of "net use" command. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery, Exfiltration, Initial Access, Lateral Movement, Persistence, Privilege Escalation and Technique(s): T1021.002, T1048.003, T1049, T1078.002, T1135. | win |
Net User Add | Identifies account creation using net user /add. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence and Technique(s): T1136.001. | win |
Net user command execution | Detects execution of the "net user" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Persistence and Technique(s): T1087.002, T1136.001. | win |
NET USER COMMAND EXECUTION (METHODOLOGY) | This IOC detects the execution of net user command. This is associated with MITRE ATT&CK (r) Tactic(s): Impact, Persistence, Credential Access and Technique(s): T1531, T1078.001, T1078.002, T1078.003, T1110.004, T1110.001. | win |
NET USER DELETE (METHODOLOGY) | This IOC detects the delection of a user account using net utility. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1531. | win |
Net View Command Execution | Detects execution of "net view" commands. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018, T1135. | win |
Netsh execution | Detects execution of the Windows netsh utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery and Technique(s): T1016, T1518.001, T1562.001. | win |
Netsh Firewall Interaction | Looks for attacker's use of netsh to modify firewall settings/rules. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.004. | win |
Netsh Interface Command | Identifies use of netsh to show network interface settings. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
NETSH.EXE MALICIOUS HELPER OBJECT B (METHODOLOGY) | Netsh contains functionality to add helper DLLs for extending its functionality. Once loaded, the DLL will be execute every time netsh is executed. This can be used by malware for persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.007. | win |
Netstat execution | Detects execution of the Windows netstat utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1049. | win |
Network connection from appdata | Looks not processes running from the "appdata" directory making an IPv4 network connection. Attackers frequently operate out of the appdata directory, so this may identify suspicious processes. Additional tuning will likely be needed within an enterprise environment. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1095. | win |
Network connection from programdata | Looks not processes running from the "programdata" directory making an IPv4 network connection. Attackers frequently operate out of the programdata directory, so this may identify suspicious processes. Additional tuning will likely be needed within an enterprise environment. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1095. | win |
Network connection from temp | Looks not processes running from a directory named "temp" making an IPv4 network connection. Attackers frequently operate out of "temp" directories, so this may identify suspicious processes. Additional tuning will likely be needed within an enterprise environment. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1095. | win |
NETWORK SHARE CONNECTION REMOVAL (METHODOLOGY) | This IOC detects the removal of a network share using net utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.005. | win |
Network Share Removal | Identifies removal of network shares. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.005. | win |
New Application in AppCompat | Identifies processes run on the system based on appclication compatibility assistant. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1106. | win |
NLTEST EXECUTION (METHODOLOGY) | Nltest is a built-in command-line tool that can be used to get a list of domain controllers, force a remote shutdown, query the status of trust etc. The IOC detects various actions associated with Nltest. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
NMAP EXECUTION (METHODOLOGY) | This IOC detects execution of nmap port scanning tool. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1046. | win |
NSLOOKUP (UTILITY) | NSLOOKUP is a benign utility to query the domain name system, attackers can use it to discover remote systems. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
OBFUSCATED COMMANDLINE (METHODOLOGY) | This IOC detects different obfuscations present in the process commandline. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion Execution and Technique(s): T1027, T1059 | win |
OBFUSCATION TECHNIQUES (METHODOLOGY) | Attackers often use javascript commands like fromcharcode or store the commands in document shapes to hide the actual commands being executed. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1027, T1059.007. | win |
OBFUSCATION USING ECHO REPLACE FEATURE (METHODOLOGY) | Attackers have used the replace feature of echo command to obfuscate the commands being executed. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion Execution and Technique(s): T1027, T1059. | win |
Oracle Database Network Connection | Identifies network connections to Oracle databases by port. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Impact and Technique(s): T1110.002, T1489. | win |
PACKET CAPTURE (METHODOLOGY) | This IOC detects execution of packet capture tools. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Discovery and Technique(s): T1040. | win |
PAEXEC EXECUTION (UTILITY) | This IOC detects the execution of PAEXEC, a redistributable version of PSEXEC. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Lateral Movement and Technique(s): T1570, T1021.002, T1569.002. | win |
PAS WEBSHELL (FAMILY) | P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Command and Control, Credential Access, Execution, Collection, Defense Evasion, Persistence and Technique(s): T1087.001, T1071.001, T1110.001, T1059, T1213, T1005, T1140, T1083, T1070.004, T1105, T1046, T1027, T1505.003, T1518. | win |
PASSWORD CHANGER (METHODOLOGY) | This IOC detects the execution of net user command to change password. This is associated with MITRE ATT&CK (r) Tactic(s): Impact, Persistence, Credential Access and Technique(s): T1531, T1078.001, T1078.002, T1078.003, T1110.004, T1110.001. | win |
Peripheral device discovery | Identifies attempts to identify host device information. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1047, T1059.001, T1120. | win |
Peripheral Discovery Registry | Identifies attempts to enumerate peripheral devices by reading the Windows registry. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1120. | win |
PERSISTENT MSHTA.EXE PROCESS EXECUTION (METHODOLOGY) | This alert looks for suspicious mshta.exe usage in common persistence locations. Mshta.exe is a native Windows signed binary that can be used to execute local or remote .hta files. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.005. | win |
Ping execution | Detects execution of the Windows ping utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
PIPESHELL (FAMILY) | Pipeshell is a simple powershell script that supports running powershell commands on remote machine using named pipes. This IOC looks for Pipeshell commands in powershell consolehost history. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Command And Control and Technique(s): T1059.001, T1090.001. | win |
PLINK (UTILITY) | Attackers may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. This is associated with MITRE ATT&CK (r) Tactic(s): Command and Control and Technique(s): T1572. | win |
Port 53 Network Connection | Identifies uncommon processes communicating on port 53, generally associated with DNS. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071.004. | win |
Port 80/433/8080/8443 Network Connection | Identifies interesting applications making network connections to ports 80, 433, 8080 and 8443, associated with HTTP and HTTPS. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071.001. | win |
POSSIBLE APPLICATION SHIMMING (METHODOLOGY) | This IOC detects possible attempt at Application Shimming. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.011. | win |
Possible ChromePass execution (Credential Stealer) | ChromePass password recovery tool execution. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1555.003. | win |
POSSIBLE DLL HIJACKING ATTEMPT (METHODOLOGY) | The IOC detects either the creation of a new DLL file or overwriting of an existing one within the Windows directory, which could indicate a possible attempt at DLL hijacking. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation, Defense Evasion and Technique(s): T1574.001, T1036. | win |
POSSIBLE FILE ASSOCIATION MODIFICATION (METHODOLOGY) | This IOC detects the execution of assoc utility, which would indicate a possible attempt at altering default file association. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.001. | win |
POSSIBLE MIMIKATZ PRESENCE (FAMILY) | This IOC looks for the presence of mimikatz-related files. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003.001, T1003.002, T1003.004. | win |
POSSIBLE PASS THE HASH ATTACK (METHODOLOGY) | Attackers may "pass the hash" using stolen password hashes to move laterally within an environment, bypassing normal system access controls. This IOC detects Pass the hash (PtH) method of authenticating as a user without having access to the user's cleartext password. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement and Technique(s): T1550.002. | win |
POSSIBLE PASSWORD FILTER DLL REGISTRATION (METHODOLOGY) | This IOC detects the possible registration of a password filter DLL. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Defense Evasion and Technique(s): T1556.002. | win |
Possible PowerUp script execution (Utility) | Detects PowerUp PowerShell script execution. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Privilege Escalation and Technique(s): T1059.001, T1543.003, T1574.001, T1574.010. | win |
POSSIBLE RDP ENABLE ATTEMPT VIA NETSH (METHODLOGY) | This IOC detects the creation of a Windows Firewall rule via netsh to allow incoming RDP connections. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement and Technique(s): T1562.004, T1021.001. | win |
POSSIBLE REMOTE ACCESS TOOLS (METHODOLOGY) | This IOC detects possible presence of remote access tools and utilities. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Lateral Movement and Technique(s): T1105, T1219, T1021.001, T1021.005. | win |
POSSIBLE REMOTE ACTIVITY VIA WMIC (METHODOLOGY) | This IOC detects the possible execution of a command at a remote sytem using WMIC. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Lateral Movement and Technique(s): T1047, T1021.006. | win |
POSSIBLE SCREEN CAPTURE ACTIVITY (METHODOLOGY) | This IOC detects the possible attempt at screen capturing. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1113. | win |
POSSIBLE SHARPHOUND (UTILITY) | This IOC detects the possible use of SharpHound utility. This is associated to MITRE ATT&CK (r) Tactic: Collection and Technique: T1560, T1119. | win |
POSSIBLE SMB ENABLE ATTEMPT VIA NETSH (METHODLOGY) | This IOC detects the creation of a Windows Firewall rule via netsh to allow incoming SMB connections. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Lateral Movement and Technique(s): T1562.004, T1021.002. | win |
POSSIBLE UAC BYPASS ATTEMPT (METHODOLOGY) | This IOC detects the possible attempt at UAC based on specific registry entry using reg utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1548.002. | win |
POTENTIAL CVE-2020-1350 PRE-EXPLOITATION | This IOC looks for registry query for TcpReceivePacketSize DNS service parameter, this can be done by attackers to determine if the machine is vulnerable to CVE-2020-1350. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Lateral Movement, Privilege Escalation and Technique(s): T1059.001, T1068, T1203, T1210. | win |
POTENTIAL DATA TRANSFER USING POWERSHELL (METHODOLOGY) | This IOC detects indicators associated with the use of powershell for the purpose of data transfer. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105 | win |
POTENTIAL KEYLOGGER OUTPUT (METHODOLOGY) | Detects common keylog control characters being written to a file. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Credential Access and Technique(s): T1056.001. | win |
PowerShell Child Process | Identifies processes spawned by PowerShell. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001. | win |
POWERSHELL DOWNGRADE ATTACK (METHODOLOGY) | This IOC looks for older versions of powershell engines being loaded which is an indication of PowerShell downgrade attack. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.010. | win |
POWERSHELL DOWNLOAD AT SUSPICIOUS PATH (METHODOLOGY) | This IOC detects downloading of payloads in suspicious locations by powershell. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001. | win |
POWERSHELL DOWNLOADER G (METHODOLOGY) | This IOC captures the use of Powershell to download and execute a file or command using Net.WebClient object. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001. | win |
POWERSHELL ENCODED COMMAND (METHODOLOGY) | Attackers may use powershell to execute base64 encoded commands to avoid immediate user suspicion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1027, T1059.001. | win |
PowerShell Engine Load | Detects processes loading the PowerShell engine. This may indicate that the process implements a custom PowerShell script host, which may be used to evade security monitoring. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001. | win |
PowerShell Execution | Detects PowerShell process execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001. | win |
PowerShell File Write | Detects PowerShell writing files to disk. May detect output written to disk or files downloaded from the internet using PowerShell. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.001, T1105. | win |
PowerShell Get-Content Command | Identifies PowerShell get-content commands, used to read the contents of an item. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Credential Access and Technique(s): T1005, T1025, T1039, T1552.001. | win |
POWERSHELL HIDDEN WINDOW (METHODOLOGY) | Attackers often hide the powershell window to avoid user suspicion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1059.001, T1564.003. | win |
PowerShell loading system.directoryservices.dll | Identifies PowerShell loading system.directoryservices.dll, which may indicate attempts to identify active directory information. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
PowerShell move command execution | Detects use of PowerShell to move a file. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Command And Control and Technique(s): T1074.001, T1105. | win |
PowerShell Network Connection | Detects network connections from the PowerShell process. May detect PowerShell download cradles, some PowerShell backdoors, and other suspicious activity. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.001, T1071.001, T1105. | win |
PowerShell Network Discovery | Identifies Powershell commands associated with network configuration discovery,. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1016, T1059.001. | win |
PowerShell Process Listing | Identifies PowerShell process listing by arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1057, T1059.001. | win |
POWERSHELL PROCESS LISTING A (METHODOLOGY) | This IOC detects the use of "Get-Process" powershell module to list running processes within a system. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1057, T1059.001. | win |
PowerShell Read Clipboard | Identifies attempts to read the clipboard. The encoded text decodes to "get-clipboard". This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Command And Control, Execution and Technique(s): T1059.001, T1115, T1132.001. | win |
PowerShell URL request | Detects URL requests from PowerShell. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.001, T1071.001, T1105. | win |
PowerShell WMI Activity | Identifies PowerShell interaction with WMI based on PowerShell process arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1047, T1059.001, T1546.003. | win |
PowerShell XOR | Identifies the PowerShell binary XOR (bxor) operation. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1059.001, T1140. | win |
Private Key | Identifies enumeration and aggregation of private key files. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1552.004. | win |
PROCESS EXECUTION FROM REDIRECTED RDP DRIVE (METHODOLOGY) | This IOC detects the execution of a process through a mapped redirected local resource via an RDP system, which is a possible attempt at lateral movement. Kindly investigate the command line and parent process to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.001. | win |
Process execution startup | Looks for scripting files being executed from startup using common scripting or execution binaries. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1059.001, T1059.003, T1059.005, T1059.007, T1547.001. | win |
PsExec execution (UTILITY) | Detects default PsExec execution, on both the source and target systems. Processes created using default PsExec will be launched by "psexesvc.exe". This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Lateral Movement, Persistence, Privilege Escalation and Technique(s): T1021.002, T1543.003, T1569.002. | win |
Putty execution | Detects execution of the Windows SSH client putty, based on file name. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.004. | win |
PWDUMP (UTILITY) | Pwdump is an application that dumps password hashes from the SAM database.This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003.002 | win |
Python Activity | Identifies Python activity. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.006. | win |
Python Child Process | Identifies processes spawned by Python. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.006. | win |
Python Exectuable | Identifies execution of Python wrappers like Py2EXE and PyInstaller. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.006. | win |
Python File Write | Detects Python writing files to disk. May detect output written to disk or files downloaded from the internet using Python. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.006, T1105. | win |
Python Network Connection | Identifies network connections established by Python processes. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Execution and Technique(s): T1059.006, T1071.001, T1105. | win |
Qprocess execution | Detects execution of the Windows qprocess utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1057. | win |
Query execution | Detects execution of the Windows query utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1033. | win |
QUERY INTERNET SETTINGS REGISTRY ENTRIES (METHODLOGY) | This IOC detects the attempt to read internet configuration stored under the "Internet Settings" registry path via reg.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1012. | win |
Quser Execution | Identifies execution of the Windows quser utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1033. | win |
QWINSTA EXECUTION (METHODOLOGY) | This IOC detects execution of qwinsta utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1033. | win |
RAINBOWCRACK (UTILITY) | RainbowCrack is a tool which generates rainbow tables to be used in password cracking.This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1110.002 | win |
RANSOM NOTE | This IOC looks for typical strings found in ransom notes. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1486. | win |
Rar archive created | Identifies RAR archives being created, based on header values. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Defense Evasion and Technique(s): T1074.001, T1140, T1560. | win |
Rar execution | Identifies execution or the "rar" utility, by file name and process arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Defense Evasion and Technique(s): T1074.001, T1140, T1560. | win |
RDP Network Connection | Detects Windows Remote Desktop Protocol (RDP) connections, based on network port. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Credential Access, Exfiltration, Lateral Movement and Technique(s): T1021.001, T1048.001, T1048.002, T1071.002, T1110.002. | win |
Rdpclip Execution | Detects execution of the Windows rdpclip utility, which is used to support copying files to/from an RDP session. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
Reg execution | Detects execution of the Windows reg utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery and Technique(s): T1012, T1112. | win |
Reg Query Service | Identifies registry queries used to discover service configuration details. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1007, T1012. | win |
Regedit Execution | Detects execution of the Windows regedit utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery and Technique(s): T1012, T1112. | win |
Registry Modified | Identifies Registry modification. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1112. | win |
Registry Modified with B64 encoded data | Identifies modifications of the registry with base64 encoded data. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1027. | win |
Registry Modify | Identifies modifications of the registry. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1112. | win |
Registry Query | Identifies reg query commands. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1012, T1518.001. | win |
Remote desktop activity | Identifies use of the Windows remote desktop client "mstsc.exe". This will identify activity on the source system of RDP-based lateral movement on Windows systems. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.001. | win |
REMOTE SHARE CONNECTION WITH NET.EXE (METHODOLOGY) | This IOC detects the connection to remote shares using net.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.002. | win |
REMOVAL OF BASH HISTORY (METHODOLOGY) | This IOC captures the attempt to remove the .bash_history file in Windows linux subsystem using rm command. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.003. | win |
REMOVAL OF SYSMON UTILITY FROM SYSTEM (METHODLOGY) | This IOC detects the possible attempt to remove Sysmon SysInternals utility, either by unloading the sysmon driver or by uninstalling sysmon itself. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
RENAMED CERTUTIL (METHODOLOGY) | This IOC detects the possible execution of a certutil command by a utility not named as certutil. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.003, T1140. | win |
RENAMED POWERSHELL (METHODOLOGY) | This IOC detects possible usage of renamed powershell for masquerading purpose. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1036.003, T1059.001. | win |
RENAMED SCHTASKS (METHODOLOGY) | This IOC detects possible usage of renamed schtasks for masquerading purpose. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.003. | win |
RENAMED WINDOWS SCRIPTING UTILITY (METHODOLOGY) | This IOC detects possible usage of renamed wscript or cscript for masquerading purpose. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.003. | win |
RETRIEVAL OF HOTFIXES INSTALLED (METHODOLOGY) | This IOC detects the execution of a WMIC command to retrieve list of hotfixes installed. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
REVIEW OF BASH HISTORY (METHODOLOGY) | This IOC captures the attempt to review the .bash_history file in Windows linux subsystem using cat command. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1552.003. | win |
Route execution | Detects execution of the Windows route utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1016. | win |
Rubeus Kerberos Ticket Activity | Identifies Rubeus kerberos ticket activity by process arguments. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Defense Evasion, Lateral Movement and Technique(s): T1550.003, T1558.003. | win |
Run Key Persistence | Detects modification of Windows "run" and "runonce" registry persistence keys. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1112, T1547.001. | win |
Runas execution | Detects execution of the Windows runas utility, which is used to run a process in the context of a different user. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Privilege Escalation and Technique(s): T1059.003, T1134.002. | win |
Rundll32 Execution | Detects execution of Windows rundll32 utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.011. | win |
RUNDLL32 FILE WRITE | Detects Rundll32 writing files to disk. May detect output written to disk or files downloaded from the internet using Rundll32.This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Command And Control and Technique(s): T1218.011, T1105. | win |
Rundll32 Network Connection | Identifies rundll32.exe establishing network connections. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion and Technique(s): T1105, T1218.011. | win |
Rundll32 Not Running DLL | Identifies Rundll32 used to run files without .dll extension. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.004, T1218.011. | win |
Rundll32 URL request | Identifies Rundll32 establish a network connection URL request. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion and Technique(s): T1071.001, T1105, T1218.011. | win |
RYUK RANSOMWARE | RYUK is a ransomware that uses a combination of public and symmetric-key cryptography to encrypt files on the host computer. This IOC looks for indicators of ryuk ransomware execution. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1486. | win |
SC Create | Identifies the sc create command used to create Windows services. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1543.003. | win |
SC DELETE COMMANDLINE (METHODOLOGY) | Identifies the sc delete command used to delete Windows services.This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1569.002. | win |
SC execution | Detects execution of the Windows sevice controller utility sc. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution, Persistence, Privilege Escalation, Impact and Technique(s): T1007, T1543.003, T1569.002, T1489. | win |
SC Modify Service | Identifies use os the Windows sc utility to modify an existing Windows service. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation, Impact and Technique(s): T1543.003, T1489. | win |
SC Service Discovery | Identifies execution of the Windows sc command to identify Windows service details. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1007, T1569.002. | win |
SC Start | Identifies use of SC to start a service. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1569.002. | win |
SC Stop | Identifies the use of sc to stop a service. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Impact, Execution and Technique(s): T1489, T1562.001, T1569.002. | win |
SCHEDULE TASK ON REMOTE HOST (METHODOLOGY) | This IOC detects the creation of a scheduled task on remote host. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.005. | win |
Scheduled Task Activity | Detects Windows scheduled task activity based on execution of the "at" and "schtasks" utilities and modification of scheduled task files. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.005. | win |
Scrcons child | Detects activity by the WMI scripting host scrcons.exe, which may indicate WMI activescript event consumer execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001, T1059.005. | win |
Script File Created | Identifies script files by extension. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059. | win |
Sdclt Child Process | Identifies processes spawned by sdclt.exe, which may indicate a UAC bypass. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1548.002. | win |
Sdelete command execution | Detects execution of the sysinternals sdelete command based on file name. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.004. | win |
Sdelete file write | Detects execution of the sysinternals sdelete command based on how it renames files. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.004. | win |
SECRETSDUMP (CREDENTIAL STEALER) | SECRETSDUMP is a python module available in public used to steal credentials. It is capable of SAM hash dumping ,exporting certificates and private keys of the executing user as well as remote user. This is associated to MITRE ATT&CK (r) Tactic: Credential Access and Technique: T1003.002, T1003.003. | win |
SECRETSDUMP B (CREDENTIAL STEALER) | SECRETSDUMP is a python module available in public used to steal credentials. It is capable of SAM hash dumping ,exporting certificates and private keys of the executing user as well as remote user. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003.006. | win |
SECURITY ACCOUNT MANAGER FILE DUMPING (METHODOLOGY) | This IOC detects the creation of SAM (Security Acccount Manager), System files, which could indicate a possible attempt at credential dumping. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003.002. | win |
Security Software Discovery | Identifies attempts to discover the installed antivirus, antispyware and firewall on the system. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1047, T1059.001, T1518.001. | win |
SERVICE CREATION FOR COMMAND EXECUTION (METHODLOGY) | This IOC detects sc.exe being leveraged to execute any given command. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1569.002, T1543.003. | win |
SERVICE DISABLE | This IOC detects the disabling of a service. Attackers may disable security services to avoid detection or disable normal services to achieve service disruption. This is associated with MITRE ATT&CK (r) Tactic(s): Impact, Defense Evasion and Technique(s): T1489, T1562.001. | win |
Service Execution | Identifies uncommon binaries run as a service, based on services.exe parent process. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1569.002, T1059.003. | win |
Service Persistence | Detects modification of Windows service persistence registry keys. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Privilege Escalation and Technique(s): T1112, T1543.003, T1569.002, T1574.011. | win |
Set command execution | Detects Windows "set" commands based on process arguments. Will not detect "set" commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
Set command output | Detects output of the Windows "set" command being written to disk. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
SetMACE Execution | Identifies execution of the timestomping utility setmace.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.006. | win |
Setx command execution | Detects execution of the Windows setx utility to set the values of environment variables, locally or remotely. Attackers may abuse this utility to remotely modify the Windows registry. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery and Technique(s): T1012, T1112. | win |
Share Discovery | Identifies share discovery. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1049, T1135. | win |
Share Mount | Identifies network share mounting. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Exfiltration, Lateral Movement and Technique(s): T1021.002, T1048.003, T1087.002. | win |
SHUTDOWN (UTILITY) | Detects the supicious shutdown/reboot of systems to interrupt access to, or aid in the destruction of, those systems. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1529. | win |
SMBEXEC (UTILITY) | Detects execution of the Windows SMB utility, used to interact with file shares, allowing them to move laterally throughout a network. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.002. | win |
SMTP Network Connection | Identifies SMTP network traffic based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration and Technique(s): T1048.001, T1048.002, T1071.003. | win |
SNMP Network Connection | Identifies Simple Network Management Protocol (SNMP) network connections by port. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1498.001. | win |
SOLARWIND SERV-U RCE (EXPLOIT) | This IOC detects suspicious artifacts associated with SolarWinds Serv-U software remote code execution exploit. It also detects supicious child process launch from Serv-U.exe and command lines arguments provided to those child processes. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Initial Access, Discovery and Technique(s): T1190, T1203, T1033, T1083. | win |
SSH/SCP/SFTP network connection | Identifies Secure Shell (SSH), Secure Copy Protocol (SCP), and Secure File Transfer Protocol network connections based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration, Lateral Movement and Technique(s): T1021.004, T1048.001, T1048.002, T1071.002. | win |
Startup folder persistence | Detects the creation of files in the Windows startup directory, which may be used for persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.001. | win |
SUBST EXECUTION (METHODOLOGY) | This IOC detects execution of subst command. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1070.005. | win |
SUNBURST SUSPICIOUS CHILD PROCESSES (METHODOLOGY) | This rule identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor. The behavior of SolarWinds.Orion.Core.BusinessLayer.dll is dependent on per-enterprise configuration, so additional tuning may be required to exclude legitimate activity in a given environment. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access and Technique(s): T1195.002. | win |
Suspicious ADS filewrite | Looks for filewrites to unusual NTFS Alternate Data Steams (ADS). This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1564.004. | win |
SUSPICIOUS AMSI.DLL (METHODOLOGY) | Attackers can copy a malicious amsi.dll and a benign executable that loads amsi.dll in unusual locations like appdata and invoke the benign executable which will then load the malicious amsi.dll from current directory. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1574.001. | win |
SUSPICIOUS ATTEMPT TO ENCRYPT FILES (METHODOLOGY) | This IOC detects the suspicious attempt to encrypt files usually seen in ransomware infections. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Impact and Technique(s): T1083, T1486. | win |
SUSPICIOUS ATTEMPT TO UPLOAD CROWN PLUGIN (EXPLOIT) | This IOC detects a suspicious connection to Atlassian Crowd server over a non-TLS channel to upload plugin file. This could be an attempt to exploit CVE-2019-11580. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access and Technique(s): T1190. | win |
SUSPICIOUS CLEARING OF WINDOWS EVENT LOGS (METHODOLOGY) | This alert will trigger on suspicious clearing of Windows event logs via Wevtutil utility. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Techniques(s): T1070.001. | win |
SUSPICIOUS CODE EXECUTION FROM WINDOWS DEFENDER (EXPLOIT) | This IOC detects suspicious execution of a new process from windows defender. This could be due to potential exploitation of CVE-2021-1647. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Privilege escalation and Technique(s): T1203, T1068. | win |
SUSPICIOUS COMMANDS FROM HTTPD A (METHODOLOGY) | This IOC looks for suspicious commands from Apache HTTP server which might be an indicator of active exploitation or the presence of a webshell. Investigate the source of activity and the processes launched to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access, Persistence and Technique(s): T1190, T1505.003. | win |
SUSPICIOUS CREATION OF EXECUTABLE FILE BY IIS WORKER (METHODOLOGY) | This IOC detects the suspicious creation of an executable file by IIS worker process. Attackers can exploit vulnerabilities in plugins such as RadAsyncUpload by Telerik (CVE- 2019-18935) to cause IIS worker process to execute code from uploaded files. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access, Persistence and Technique(s): T1190, T1505.003. | win |
SUSPICIOUS CREATION OF SHADOWCOPY (METHODOLOGY) | This alert will trigger on suspicious creation of Volume Shadow Copies. This is related to Windows Elevation of Privilege Vulnerability (CVE-2021-36934) which provides non- privileged user access to system files on affected versions. If a Volume Shadow Copy Service (VSS) shadow copy of the system drive is available, a threat actor may leverage access to the critical system files including Security Accounts Manager (SAM) database and could extract and leverage account password hashes, obtain DPAPI computer keys, which can be used to decrypt all computer private keys and more. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Techniques(s): T1003.002, T1003.003. | win |
SUSPICIOUS DISCOVERY OF ANTIVIRUS PRODUCTS USING WMI (METHODOLOGY) | Detects use of PowerShell for listing of AntiVirus products using WMI. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1518.001, T1047, T1059.001 | win |
Suspicious DLL load (methodology) | Identifies loads of known hijackable/side-loadable DLLs from uncommon locations. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Persistence, Privilege Escalation and Technique(s): T1574.001, T1574.002. | win |
Suspicious DLL load used by Scripting Interpreters (methodology) | Detects loading of the WSH Object Model runtime library, wshom.ocx. Scripting interpreters such as WSH (Windows Script Host) and MSHTA may load this library to access objects such as the WSH network object (WScript.Network) or shell object (WScript.Shell) for the purposes of reading system information or making network connections. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1033, T1059. | win |
SUSPICIOUS DNS RESOLUTION OVER HTTPS (METHODOLOGY) | This IOC detect the suspicious indicators associated with DNS resolution over HTTPS. Malware can resolve DNS through DoH services and evade URL domain based defences. This is associated with MITRE ATT&CK (r) Tactic(s): Exfiltration and Technique(s): T1048.003. | win |
SUSPICIOUS DOMAIN CONTROLLER LOGIN ATTEMPT (EXPLOIT) | This IOC detects the suspicious login attempt made to a domain controller using an empty credential. This could be a potential attempt to exploit CVE-2020-1472 which allows domain controller takeover through malicious NETLOGON requests. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Defense Evasion, Privilege Escalation and Technique(s): T1068, T1556.001. | win |
SUSPICIOUS EXECUTABLE CREATED (METHODOLOGY) | This IOC looks for executables created by processes executing out of public folder. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
SUSPICIOUS EXECUTABLE CREATED BY W3WP (METHODOLOGY) | This IOC detects suspicious executable file created in temp directory by IIS worker process.This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access and Technique(s): T1190. | win |
SUSPICIOUS EXECUTABLE IN PUBLIC DOWNLOADS (METHODOLOGY) | Attackers sometimes use not frequently used directories like /Users/Public/Downloads to avoid users noticing their binaries. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1204.002. | win |
SUSPICIOUS EXPLORER.EXE (METHODOLOGY) | Adversaries may use legitimate windows binary file names like explorer.exe to name their malicious binaries to avoid user suspicion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | win |
SUSPICIOUS FILE CREATED BY OFFICE APPLICATION (METHODOLOGY) | This IOC detects suspicious files written on disk by office applications. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution, Persistence, Credential Access, Lateral Movement, Discovery and Technique(s): T1204, T1547.001, T1547.009, T1187, T1497.002, T1480 | win |
SUSPICIOUS FILE CREATION (METHODOLOGY) | This IOC detects files created by ransomware with suspicious file extensions and overwrites. Kindly investigate the contents of the file and the process which wrote to this file in order to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1486. | win |
Suspicious File Name | Identifies potentially malicious files based on name and extension. These file may be used for user execution attacks. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Execution and Technique(s): T1036.005, T1204.001, T1204.002. | win |
SUSPICIOUS FILES IN PERFLOGS FOLDER (METHODOLOGY) | Adversaries may use perflogs directory as a staging environment to store files before exfiltration or to store executables before execution. This is associated with MITRE ATT&CK (r) Tactic(s): Collection, Command and Control and Technique(s): T1074.001, T1105. | win |
SUSPICIOUS FIREEYE AMSI PLUGIN TAMPERING (METHODOLOGY) | This IOC detects suspicious disabling of FireEye's AMSI Module. This alert should be ignored as it is expected during uninstallation, and should be investigated if triggered otherwise. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
SUSPICIOUS GET- CHROMECREDS2 USAGE (METHODOLOGY) | This IOC detects the usage of Get-ChromeCreds2 module which can be used to acquire credentials from Chrome.This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1555.003. | win |
SUSPICIOUS IMAGE LOAD BY OFFICE APPLICATION (METHODOLOGY) | Detects winword.exe loading vbe related dlls which are used to execute macro code. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.005, T1559.001. | win |
SUSPICIOUS IMAGE LOAD BY W3WP.EXE (METHODOLOGY) | W3WP.exe is the IIS worker process that can host web applications. Vulnerabilities in different web application frameworks like Telerik can sometimes make W3WP.exe load malicious DLLs to achieve remote code execution. This IOC looks for suspicious DLL loads by w3wp.exe process. Kindly investigate the image being loaded to confirm maliciousness. This is associated with MITRE ATT&CK (r) Tactic(s): Initial Access and Technique(s): T1190. | win |
SUSPICIOUS INVOCATION OF SVCHOST (METHODOLOGY) | This IOC looks for suspicious parent process of svchost.exe, this could be an indication of a malicious process trying to launch svchost.exe for injection purposes. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1055 | win |
Suspicious LNK File | Identifies unexpected LNK files being written to the system. Malicious LNK files may be used in a range of attacks, including for user execution, credential access, and persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Discovery and Technique(s): T1187, T1204.002, T1547.001, T1547.009, T1497.002, T1480, T1204.001. | win |
SUSPICIOUS MODIFICATION OF POWERSHELL PROFILE (METHODOLOGY) | PowerShell profile contains commands that runs when PowerShell starts. This can be used as a logon script to customize user environments. Malware can add malicious commands to profile files to attain persistence. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.013. | win |
SUSPICIOUS MODIFICATION OF SID-HISTORY (METHODOLOGY) | Security IDentifier (SID) is used to track the security principal and the access the account has when connecting to resources. Malware can modify the SID History of a used in the infected host to attain Domain Admin privileges. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1134.005. | win |
SUSPICIOUS MSHTA EXECUTION (METHODOLOGY) | This indicator detects suspicious launch of MSTHA process by explorer.exe. This parent child relationship is typically seen when mshta is executed by .lnk file.This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.005. | win |
SUSPICIOUS NON- APPLICATION LAYER CONNECTION (METHODOLOGY) | This IOC detects indicators related to suspicious network connection made by processes inside %TEMP%. Malware tend to use these channels to hide their communication from monitoring tools. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1095 | win |
Suspicious Office Document Created | Identifies the creation of uncommon office file formats, including macro-enabled file and legacy formats. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1204.002. | win |
Suspicious PE File | Identifies Windows PE files with unexpected file extensions. This may indiacte attempts to hide the nature of the file. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005. | win |
SUSPICIOUS PROCESS LAUNCH BY SLUI.EXE (METHODOLOGY) | SLUI is a legitimate windows utility that is assciated with user interface for software licensing. However, publicly documented bypasses for UAC exist which allow it to be misused in order to spawn an elevated process without a UAC check. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1548.002. | win |
SUSPICIOUS REG FILE CREATION (METHODOLOGY) | This IOC looks for creation of .reg files. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
SUSPICIOUS REGSVR32 CMDLINE (METHODOLOGY) | Regsvr32.exe can be used as an application whitelisting bypass to execute script contents embedded in a local file irrespective of file extension. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218.010. | win |
SUSPICIOUS RTF | This IOC looks for RTF files that do not have the rtf file extension. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036. | win |
SUSPICIOUS RUN REGISTRY ADDITION (METHODOLOGY) | This IOC detects the suspicious value added in the run registry via reg utility. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.004. | win |
SUSPICIOUS SCREESAVER MODIFICATION (METHODOLOGY) | Screensavers in windows are custom PE files with .scr extension and are configured to execute after a pre-configured amount of user-inactivity. Malwares can modify this behaviour by modifying the registry value of SCRNSAVE. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1546.002. | win |
SUSPICIOUS SYSINTERNALS TOOLS EXECUTION | This IOC looks for possible sysinternals tools executing with masqueraded file names. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.003. | win |
SUSPICIOUS URL SHORTCUT (METHODOLOGY) | Adversaries may modify the URL shortcut files to establish persistence on victim machine. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.009. | win |
SUSPICIOUS USAGE OF SET AND START COMMAND (METHODOLOGY) | This IOC detects the usage of set and start command.This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1106. | win |
SUSPICIOUS USAGE OF WINLOGON REGISTRY (METHODOLOGY) | This IOC detects the suspicious usage of winlogon registry. This is associated with MITRE ATT&CK (r) Tactic(s): Persistence, Privilege Escalation and Technique(s): T1547.004. | win |
SUSPICIOUS USE OF CERTUTIL TO OBFUSCATE PAYLOAD EXECUTION (METHODOLOGY) | This IOC detects the suspicious execution of certutil binary to download and decode payload from remote server. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Command And Control and Technique(s): T1036.003, T1140, T1132.001. | win |
SUSPICIOUS WERFAULT INVOCATION (METHODOLOGY) | This IOC looks for wefault.exe being launched with no command line options, this could be an indication of werfault,exe being launched for injection purposes. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1055. | win |
SUSPICIOUS WMI EXECUTE RUNDLL32 (METHODOLOGY) | This IOC detects Windows Management Instrumentation (WMI) host process wmiprvse.exe executing rundll32.exe. This technique has been used for lateral movement, in order to achieve code execution on the remote host. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Defense Evasion and Technique(s): T1047, T1218.011. | win |
SUSPICIOUS WUAUCLT (METHODOLOGY) | Adversaries may use benign windows binaries like wuauclt.exe to proxy execution of their malicious binary. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1218. | win |
SVCHOST CHILD PROCESS (METHODOLOGY) | This IOC looks for suspicious child process of svchost.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1055. | win |
Sysinternals utility execution | Detects sysinternals utilities based on the -accepteula command-line argument, which is required at the first execution of the utility, if run from the command-line. These tools provide a wide range of capabilities and are often used legitimately. | win |
System Info Aggregation | Identifies potential WMI/PowerShell systeminformation discovery commands. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1033, T1047, T1059.001, T1082. | win |
SYSTEM PROCESS NETWORK CONNECTION (METHODOLOGY) | This IOC detects network connections from the system process. It detects system process download cradles, some backdoors, and other suspicious activity. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071.001, T1105. | win |
SYSTEM PROCESS URL REQUEST (METHODOLOGY) | This IOC detects URL requests from system process.This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071.001, T1105. | win |
SYSTEM REBOOT WIN (METHODOLOGY) | This IOC detects a suspicious reboot of a Windows machine. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1529. | win |
SYSTEM SHUTDOWN WIN (METHODOLOGY) | This IOC detects a suspicious shutdown of a Windows machine. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1529. | win |
SYSTEM TIME DISCOVERY (METHODOLOGY) | This IOC detects discovery of the system time.This information is useful to an attacker to perform additional activities. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1124. | win |
SYSTEM TIME DISCOVERY (METHODOLOGY) | This IOC detects different attempts to obtain system time. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1124. | win |
SYSTEM32 WMIC.EXE PROCESS CALL CREATE (METHODOLOGY) | This alert looks for a system32 binary directly launching wmic.exe (even a renamed version of this binary) and the PROCESS CALL CREATE arguments to launch a local or remote process. This has been seen used in scenarios where the attacker has injected into a legitiamte system32 binary using a backdoor such as Cobalt Strike BEACON to then issue child processes from the selected system32 post-exploitation binary, also running injected code. This is associated to MITRE ATT&CK (r) Tactic: Execution and Technique: T1059.001, T1059.003. | win |
Systeminfo execution | Detects execution of the Windows systeminfo utility. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
Systeminfo output | Detects output of the Windows systeminfo utility being written to disk. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
Takeown execution | Detects execution of the Windows takeown utility, which can be used to change file ownership. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1036.005, T1222.001. | win |
TASK CREATION ON REMOTE SYSTEM (METHODLOGY) | This IOC detects the creation of a scheduled task to be executed possibly on a remote machine, using schtasks.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.005. | win |
TASK SET TO RUN ON STARTUP (METHODOLOGY) | This IOC detects the creation of a scheduled task set to execute on startup, using schtasks.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation and Technique(s): T1053.005. | win |
Taskkill execution | Detects execution of the Windows taskkill command, used to end Windows processes. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Impact and Technique(s): T1562.001, T1489. | win |
Tasklist execution | Detects execution of the Windows tasklist command, used to list processes and services. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1007, T1057, T1518.001. | win |
Telnet Network Connection | Identifies telnet network traffic by port. Telnet is a plaintext protocol and should generally be avoided. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration and Technique(s): T1048, T1071. | win |
Temp Directory PE Write | Identities PE files written to the Windows temp directories. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Defense Evasion and Technique(s): T1036, T1105. | win |
TESTSIGNING ON | Adversaries may enable testsigning on windows to facilitate the loading of a malicious driver. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1553.006. | win |
TFTP Network Connection | Identifies Trivial File Transfer Protocol (TFTP) network traffic by port. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration and Technique(s): T1048, T1071.002, T1105. | win |
TIGHTVNC (UTILITY) | This looks for files that are related to tightvnc utility. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
Tracert execution | Detects execution of the tracert command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1018. | win |
Tree command execution | Detects Windows "tree" file listing commands. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1059.001, T1059.003, T1083. | win |
Tree command output | File containing output from the "tree" command. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1083. | win |
Treesize command | Detects execution of the treesize utility, based on file name. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1083. | win |
TRICKBOT (BACKDOOR) | Trickbot is a trojan that installs scheduled tasks with legitimate looking names to masquerade as legitimate activity. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence, Privilege Escalation, Defense Evasion and Technique(s): T1053.005, T1036.004. | win |
TSClient file write | Detects files copied to a local shared drive in an RDP session. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration and Technique(s): T1048, T1105. | win |
Type command execution | Detects Windows type commands based on process arguments. Will not detect commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery, Execution and Technique(s): T1059.001, T1059.003, T1083. | win |
UAC DISABLE VIA REGISTRY (METHODOLOGY) | This IOC detects the attempt to disable User Access Control via Registry. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Privilege Escalation and Technique(s): T1548.002. | win |
Uncommon port connection | Identifies uncommon port usage. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1571. | win |
Unusual Internet-Sourced File | Identifies uncommon file types downloaded from the internet. These may be used in user execution attacks. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1204, T1204.001. | win |
Unusual Outlook Parent Process | Identifies the outlook client process being run by a process other than explorer.exe. This is associated with MITRE ATT&CK (r) Tactic(s): Collection and Technique(s): T1114. | win |
USB DEVICE DISCOVERY (METHODOLOGY) | This IOC detects the use of Win32_USBControllerDevice WMI class to get list of connected usb devices. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1120. | win |
User and Domain ENV | Identifies references to user and domain environment variables. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1059.001, T1059.003. | win |
User Directory File Write | Identifies file writes to user directories. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
USER EXECUTION (METHODOLOGY) | Adversaries often rely on user executing the malicious file in order to get code execution. This is associated with MITRE ATT&CK (r) Tactic(s): Execution and Technique(s): T1204.002. | win |
Vaultcli.dll load | Detects load of the Windows credential management library "vaultcli.dll", by non-standard processes. This may be associated with credential theft. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003. | win |
Ver command execution | Detects Windows "ver" commands based on process arguments. Will not detect ver commands within the command processor, as those commands are internal and do not spawn a new process. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
Ver command output | Detects output of the Windows cmd "ver" command written to disk. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1082. | win |
Virtualization/Sandbox Evasion | Identifies commands used in virtualization identification and sandbox evasion. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Discovery, Execution and Technique(s): T1047, T1059.001, T1497.001. | win |
VNC Network Connection | Identifies VNC network connections based on port. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Credential Access, Defense Evasion, Execution, Initial Access, Lateral Movement, Persistence, Privilege Escalation and Technique(s): T1021.001, T1021.005, T1071, T1072, T1078, T1110, T1133, T1219. | win |
VSSADMIN RESIZE | Vssadmin resize shadowstorage command can be used by ransomwares to force deletion of existing shadow copies to inhibt system recovery. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1490. | win |
VSSADMIN SHADOW COPY LIST (METHODOLOGY) | This IOC detects the usage of vssadmin listing. This gives information about shadow copies, creation date, and location of each copy on a computer. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1083. | win |
w3wp process creation | Detects processes spawned by the Windows web server binary "w3wp.exe", which may indicate process execution from a web shell. This is associated with MITRE ATT&CK (r) Tactic(s): Execution, Persistence and Technique(s): T1059, T1059.006, T1059.007, T1505.003. | win |
Web Service C2 | Identifies requests for legitimate web services from unexpected applications. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1071, T1102. | win |
WebDav Activity | Identifies webdav activity. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration and Technique(s): T1048, T1105. | win |
WebDav Network Request | Detects plaintext WebDav network requests based on user agent. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control, Exfiltration and Technique(s): T1048, T1105. | win |
wevtutil command | Detects execution of the Windows "wevtutil" command, used to modify event log settings or clear logs. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
WGET EXECUTION (METHODOLOGY) | This IOC detects the execution of WGET command. This is associated with MITRE ATT&CK (r) Tactic(s): Command And Control and Technique(s): T1105. | win |
Whoami execution | Detects execution of the Windows "whoami" command, used to show the current user context. This is associated with MITRE ATT&CK (r) Tactic(s): Discovery and Technique(s): T1033, T1069. | win |
WIFI PASSWORD EXTRACTION (METHODOLOGY) | IOC detects possible extraction of WiFi passwords using netsh. This is associated with MITRE ATT&CK (r) Tactic(s): Credential Access and Technique(s): T1003. | win |
WINDOWS BACKUP DELETION (METHODOLOGY) | Wbadmin is a utility that can be used to delete windows backup catalog. Adversaries usually use this technique to inhibit system recovery. This is associated with MITRE ATT&CK (r) Tactic(s): Impact and Technique(s): T1490. | win |
WINDOWS DEFENDER DISABLE VIA REGISTRY (METHODOLOGY) | IOC detects disabling of Windows defender via registry. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1112, T1562.001. | win |
WINDOWS DEFENDER SERVICE DISABLE | IOC detects disabling of Windows Defender service. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.001. | win |
WINDOWS FIREWALL DISABLE VIA NETSH | This IOC detects the possible attempt to disable Windows Firewall via netsh. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion and Technique(s): T1562.004. | win |
WINDOWS REMOTE MANAGEMENT (UTILITY) | WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system.Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement,Execution and Technique(s): T1021.006,T1047. | win |
WINDOWS UDPATE SERVICE DISABLE (METHODOLOGY) | IOC detects disabling of Windows update service. This is associated with MITRE ATT&CK (r) Tactic(s): Defense Evasion, Impact, Persistence, Privilege Escalation and Technique(s): | win |
WinRM Network Connection | Identifies network connections using the default WinRM ports 5985 (HTTP) and 5986 (HTTPS) and user agent. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.006. | win |
WinRM Process Activity | Identifies Windows Remote Management (WinRM) activity. This is associated with MITRE ATT&CK (r) Tactic(s): Lateral Movement and Technique(s): T1021.006. | win |