Threat briefs

Adversaries can achieve persistence by modifying the AutodialDLL registry key to load a malicious DLL through the Windows Winsock2 library.

Detection of registry modifications targeting Autostart Extensibility Points within the Wow6432Node hive, a common technique for achieving persistence on Windows systems.

Detection of unauthorized modifications to Windows registry keys that enable persistence through autostart extensibility points within the NT CurrentVersion hive.

Detection of child processes spawned by winrshost.exe identifying potential lateral movement and remote command execution via Windows Remote Management (WinRM).

Detection logic for identifying WinRAR execution from non-standard directories, a technique often used by attackers to stage archives for data collection and exfiltration.

Detection of unauthorized remote command execution via PSEXESVC where child processes are spawned with SYSTEM-level privileges.

This brief documents the detection logic for identifying the use of the Sysinternals PsExec utility, a common tool for lateral movement and remote code execution.

Detection of the execution of the Sysinternals Procdump utility, which is frequently used by attackers to dump process memory for credential access.

This brief documents detection logic for identifying potential malicious file downloads and C2 communication using native Windows command-line tools and PowerShell cmdlets.

Adversaries frequently abuse native Windows utilities like vssadmin and wmic to create volume shadow copies, a precursor to offline credential theft via NTDS.dit extraction.

Attackers can abuse the NTFS $INDEX_ALLOCATION stream to create directories that are inaccessible to standard Windows utilities like Explorer and PowerShell, facilitating stealthy data storage.

Adversaries utilize NTFS Alternate Data Streams to hide and execute malicious payloads, evading detection by conventional file analysis tools.

Detection of unauthorized child process execution by critical Windows system binaries commonly associated with SeDebugPrivilege exploitation.

The Windows utility sdclt.exe is frequently leveraged by threat actors to perform User Account Control (UAC) bypass by spawning unauthorized child processes with elevated privileges.

Adversaries may use the legitimate Windows sdbinst.exe binary to install malicious application shim databases for the purpose of maintaining persistence or escalating privileges.

Adversaries use the sc.exe utility to modify service security descriptors to achieve persistence, escalate privileges, or hide malicious services from standard management tools.

Adversaries can exploit the Windows 'sc.exe' utility to modify service Discretionary Access Control Lists (DACLs) via the 'sdset' command, facilitating privilege escalation and persistence by granting unauthorized service access.

Adversaries may execute malicious payloads by leveraging rundll32.exe with non-standard file extensions to bypass simple filename-based security controls.

This brief documents common LOLBIN usage of rundll32.exe to execute arbitrary code or bypass security controls through legitimate Windows DLLs.

Attackers use the mshtml.dll RunHTMLApplication export via rundll32.exe to execute arbitrary code through various protocol handlers.

Adversaries utilize the Python '-c' flag to execute arbitrary code or payloads directly from the command line, bypassing file-based execution triggers.

Attackers can leverage the legitimate Windows print.exe utility to perform unauthorized remote file copying, facilitating data staging and exfiltration.

Detection of potentially malicious PowerShell script execution originating from common temporary directory paths, often indicative of staged payload execution.

This brief details a detection strategy for identifying PowerShell command-line activity associated with common file download patterns used by various threat actors.

This brief covers the detection of suspicious PowerShell activity involving the use of web download cmdlets to retrieve and save DLL files to the local file system.

Detection of the ConvertTo-SecureString cmdlet usage via command-line, which is often used in adversarial scripts to handle credentials or obfuscated strings.

This detection brief identifies common malicious PowerShell command line patterns that utilize Base64 encoded arguments frequently observed in malware infection stages.

Detection of malicious PowerShell execution patterns involving Base64 encoded commands, frequently utilized by malware families such as Emotet for obfuscated payload delivery.

Adversaries utilize the netsh.exe utility to impair host-based security by removing active firewall rules, potentially facilitating unauthorized lateral movement or command-and-control communication.

Adversaries frequently use the Windows native 'net.exe' utility to perform discovery of privileged user groups and account configurations to facilitate lateral movement and privilege escalation.