Threat briefs

Adversaries are utilizing the Get-ADComputer PowerShell cmdlet to enumerate Active Directory objects configured for unconstrained delegation, a reconnaissance step often preceding ticket-based credential theft.

Adversaries may use the legitimate Windows PowerShell cmdlet Start-NetEventSession to capture network traffic and perform reconnaissance or credential theft.

Adversaries leverage the RegisterXLL COM method via PowerShell to execute malicious add-ins and achieve persistence within Microsoft Office environments.

Adversaries leverage the MSXML2 COM object within PowerShell scripts to facilitate network communication and potential code execution.

Adversaries may modify Group Policy settings via PowerShell to impair defensive capabilities or maintain persistence within a Windows environment.

Adversaries leverage native PowerShell cmdlets to manage and manipulate local user accounts for persistence and privilege escalation.

Adversaries utilize PowerShell scripts to interface with user32.dll for monitoring user keystrokes to facilitate credential theft.

Adversaries utilize the DNSExfiltrator tool to tunnel file data through covert DNS requests, bypassing traditional network egress filtering.

Adversaries leverage the PowerShell Invoke-Command cmdlet to perform lateral movement and execute arbitrary code on remote Windows hosts via WinRM.

This brief documents a detection method for identifying potentially malicious PowerShell scripts that decode base64-encoded Gzip archives to facilitate in-memory code execution.

Adversaries may enable Windows Remote Management (WinRM) to facilitate lateral movement and remote code execution on compromised systems.

Adversaries leverage PowerShell scripts to programmatically access and extract stored credentials from the Windows Credential Manager vault.

This brief documents the use of .NET reflection techniques within PowerShell to execute arbitrary code in-memory, a method frequently utilized to bypass file-based security controls.

Adversaries may use the System.DirectoryServices.AccountManagement namespace in PowerShell to programmatically create or manipulate domain accounts for persistence within Active Directory environments.

Detection of suspicious PowerShell scripts utilizing System.DirectoryServices.DirectorySearcher to enumerate Active Directory computer objects, a technique often used in reconnaissance.

Adversaries utilize PowerShell commands to query WMI objects and check for virtualization artifacts to evade sandbox and analysis environments.

Adversaries leverage native Windows PowerShell cmdlets to register, configure, and execute unauthorized scheduled tasks for persistence and lateral movement.

Adversaries use the .NET CopyFromScreen method within PowerShell scripts to capture desktop screenshots for information gathering during post-compromise operations.

Adversaries utilize automated PowerShell scripts to locate and gather sensitive documents across local file systems for subsequent exfiltration.

Detection of PowerShell activity used to enumerate Active Directory accounts with the DONT_REQ_PREAUTH flag, a precursor to AS-REP roasting attacks.

This brief documents a comprehensive set of offensive PowerShell script names and execution patterns frequently used by threat actors for reconnaissance, credential harvesting, and lateral movement, detectable via PowerShell Module Logging.

Adversaries frequently employ files with double extensions to bypass user skepticism and exploit Windows default settings that hide common file extensions.

Detection of PowerShell processes creating executable or script files in non-standard directories, a common behavior used by malware for persistence and staging.

This brief documents the detection of TeamViewer Desktop installation via file system activity, often associated with Remote Access Software usage.

Adversaries often abuse legitimate remote access software like GoToAssist to establish interactive command-and-control channels, leaving specific temporary artifacts in the user's local profile.

Adversaries frequently leverage legitimate remote access and support software to establish command and control channels; detecting these tools via DNS queries from non-browser processes provides visibility into potential unauthorized remote access.

Detection of unauthorized Windows Firewall rule additions performed by the WMI Provider Host process, a technique associated with defense impairment by ransomware actors.

Adversaries modify registry keys to disable Microsoft Office Protected View security controls, facilitating the execution of malicious documents.

Detection of unauthorized credential addition to Microsoft Entra applications, a common technique for establishing persistence and escalating privileges in cloud environments.

Detection of anomalous process loading of the Volume Shadow Copy service DLL vsstrace.dll which may indicate unauthorized attempts to interact with or disrupt shadow copy operations.