Threat briefs

Adversaries frequently leverage the C# compiler (csc.exe) to compile malicious code on-the-fly, often triggered by suspicious parent processes such as office applications or script engines.

Detection of suspicious file creation events where critical Windows system binaries write files with potentially malicious extensions, indicating potential process masquerading or system compromise.

Metabase instances configured with H2 databases are vulnerable to authenticated remote code execution via insecure Java deserialization triggered through native SQL queries, identified as CVE-2026-59827.

Adversaries frequently target the NTDS.DIT database using native Windows utilities or specialized scripts to perform offline credential cracking.

Detection logic for identifying PowerShell execution utilizing excessive special characters for command line obfuscation to bypass security monitoring.

Adversaries can abuse the legitimate Windows utility replace.exe to overwrite system files or replace existing binaries with malicious versions, facilitating persistence or privilege escalation.

PrintBrm.exe is a Living-off-the-Land Binary (LOLBIN) that can be abused by threat actors to perform unauthorized ZIP file creation or extraction on Windows systems.

Adversaries leverage the signed Windows binary mavinject.exe to perform unauthorized process injection by executing DLLs into running system processes.

Adversaries may abuse the legitimate ie4uinit.exe binary by executing it from unauthorized locations to facilitate command execution via maliciously crafted .inf files.

Adversaries leverage the native .NET InstallUtil.exe utility with specific flags to execute arbitrary code while bypassing standard logging and console output mechanisms.

Adversaries leverage the native Windows utility InfDefaultInstall.exe to execute malicious script content embedded within specially crafted INF files.

Adversaries utilize the SharpView C# port of PowerView to perform extensive Active Directory reconnaissance, domain enumeration, and discovery of sensitive network objects.

Adversaries leverage the Windows fsutil utility to modify NTFS symbolic link evaluation settings, potentially facilitating privilege escalation or lateral movement via unconventional file path resolution.

This rule identifies the use of the '<' operator with cmd.exe to read content from files or streams, a technique often used by attackers to bypass execution policy restrictions or bypass basic file-based detection.

This brief documents a detection method for the use of PowerShell to trigger MSI installations through the WMI Win32_Product class, a technique often utilized for software deployment or unauthorized persistence.

Adversaries utilize PowerShell commands to modify file system metadata, specifically targeting creation, access, and modification timestamps to evade detection and hinder forensic analysis.

Adversaries frequently use the PowerShell Compress-Archive cmdlet to stage sensitive data for exfiltration within common temporary directories, a technique used to consolidate and obfuscate collected information.

Adversaries utilize the PowerShell WindowStyle parameter to execute scripts in a hidden window, a technique often used to conceal malicious activity from user visibility.

Detection logic for PowerShell scripts utilizing the Start-Process cmdlet with the -PassThru parameter to execute processes in the background, a technique often used for stealthy execution.

Adversaries utilize automated PowerShell reconnaissance commands combined with redirection to temporary files to collect and stage system information for exfiltration.

Adversaries may use the New-PSDrive PowerShell cmdlet to map administrative network shares via SMB for lateral movement and remote file interaction.

Adversaries use PowerShell scripts leveraging Outlook COM objects to programmatically access and exfiltrate user email data from local systems.

Adversaries manipulate the User-Agent string in PowerShell web requests to masquerade C2 traffic as legitimate browser or application activity.

Adversaries may use Hyper-V PowerShell cmdlets to create and manipulate virtual machines to conceal malicious activity or establish persistence.

Adversaries use PowerShell to search local file systems and network shares for files containing embedded or insecurely stored credentials.

Adversaries often abuse PowerShell to invoke batch files, allowing for sequential command execution and complex logic within the Windows environment.

Detection of PowerShell scripts utilizing specific cmdlets to recursively enumerate file system directories, a technique historically associated with MAZE ransomware discovery operations.

Detection logic for PowerShell scripts leveraging the .NET KerberosRequestorSecurityToken class to illicitly request Kerberos tickets, a common step in Kerberoasting.

Adversaries utilize the New-PSSession cmdlet to establish remote PowerShell sessions for lateral movement and command execution within Windows environments.

Adversaries are utilizing the Get-ADComputer PowerShell cmdlet to enumerate Active Directory objects configured for unconstrained delegation, a reconnaissance step often preceding ticket-based credential theft.