Threat briefs

Adversaries utilize PowerShell parameter substring truncation to evade command-line monitoring by leveraging the built-in ability of PowerShell to parse shortened, non-standard parameter names.

Adversaries frequently leverage specific PowerShell cmdlets to download and execute malicious payloads, a common technique observed in stagers and ransomware deployment campaigns.

Adversaries utilize PowerShell to copy the Security Account Manager (SAM) registry hive from shadow copies for offline credential extraction.

Detection of attackers using NTFS Alternate Data Streams (ADS) to hide and execute malicious PowerShell scripts, effectively bypassing simple file-based scanning.

Adversaries may use PowerShell to enumerate the Local Security Authority Subsystem Service (LSASS) process as a precursor to credential dumping or process injection.

This brief documents the use of the 'FromBase64String' method within PowerShell command lines, a common technique for obfuscating malicious payloads to bypass signature-based detection.

The DSInternals PowerShell module is frequently abused by threat actors to perform unauthorized credential dumping, Active Directory offline database manipulation, and password auditing.

This brief documents common PowerShell patterns used by threat actors, including FIN7, to download and execute arbitrary payloads directly into memory using download cradles.

Adversaries utilize the nslookup utility to identify domain controllers through specific LDAP service record queries, a common step in network reconnaissance to facilitate domain-wide enumeration.

Detection of attackers using the Windows mshta.exe utility to execute malicious JavaScript code for living-off-the-land stealth execution.

Adversaries utilize the legitimate Windows mshta.exe utility to execute remote malicious HTA files, bypassing security controls by fetching code directly from web-based infrastructure.

WinPwn is an all-in-one framework utilized for internal Windows and Active Directory reconnaissance, privilege escalation, and credential theft.

Detection of the .NET-based SOAPHound utility used for unauthorized extraction of Active Directory data via Active Directory Web Services.

Adversaries utilize the Mimikatz post-exploitation framework to dump credentials and perform authentication abuse by executing specific command-line modules in Windows environments.

Detection engineering brief covering common command-line execution patterns generated by the CrackMapExec (CME) post-exploitation framework during lateral movement and command execution.

Adversaries utilize BloodHound and SharpHound to perform automated reconnaissance and enumeration of Active Directory environments, facilitating lateral movement and privilege escalation.

Adversaries, including ransomware operators, use the Windows fsutil utility to delete USN journals or truncate files to inhibit forensic analysis and support data destruction.

Adversaries are leveraging the legitimate Windows binary 'esentutl.exe' to bypass file locks and perform unauthorized copies of system credential databases such as NTDS.dit and SAM.

Adversaries use the Windows 'copy' command to exfiltrate sensitive files, such as registry hives, by accessing data from Volume Shadow Copy Service snapshots.

Adversaries utilize the Windows mklink utility to create symbolic links to Volume Shadow Copies, enabling unauthorized access to sensitive files like the SAM database for credential theft.

Detection of potential process masquerading or command-line exploitation attempts leveraging the Windows Calculator binary from non-standard system directories or with abnormal parameters.

Detection of the deprecated 'at.exe' utility executing with the interactive flag, a legacy technique often repurposed for persistence and privilege escalation.

Detection engineering brief covering the identification of malicious PowerShell scripts leveraging Windows API calls for process injection, token manipulation, and in-memory execution.

This brief documents detection logic for common PowerShell obfuscation and execution patterns frequently leveraged by attackers to maintain persistence, bypass security policies, and download secondary payloads.

PowerView is an open-source PowerShell module frequently used by threat actors for domain reconnaissance, user enumeration, and identifying lateral movement opportunities.

This brief covers detection logic for identifying the use of the Mimikatz credential dumper within PowerShell scripts to extract sensitive Windows authentication material.

Adversaries utilize NTFS Alternate Data Streams (ADS) to conceal malicious payloads and configuration data on Windows systems by appending information to existing files.

This brief documents detection signatures for the Nishang offensive PowerShell framework, a collection of scripts used for post-exploitation, lateral movement, and credential theft.

This brief documents a comprehensive list of commandlet patterns associated with common PowerShell-based exploitation frameworks, privilege escalation tools, and post-exploitation modules used by threat actors.

This brief covers detection strategies for the Rubeus hacktool, which is frequently used by attackers to perform Kerberos-based credential theft and lateral movement.