Threat briefs

Adversaries leverage the Windows Installer service (msiexec.exe) to download and execute malicious MSI packages directly from remote web URLs to facilitate stage-two payload delivery.

XORDump is a utility used by attackers to dump process memory, specifically targeting lsass.exe to facilitate credential theft.

Adversaries use the SelectMyParent utility to perform Parent Process ID (PPID) spoofing, enabling stealthy process execution by masquerading as legitimate system processes.

Attackers can leverage the findstr.exe utility to download or read content from remote SMB shares using specific command-line arguments, potentially facilitating file exfiltration or second-stage payload delivery.

Attackers utilize the C# compiler (csc.exe) to dynamically compile and execute malicious code in memory, enabling evasion of signature-based defenses and EDR hooks.

Adversaries are utilizing the legitimate Windows utility createdump.exe to perform unauthorized memory dumping, facilitating credential theft.

Adversaries utilize PowerShell to establish persistence and achieve privilege escalation by creating WMI event subscriptions that execute malicious payloads upon system triggers.

This brief documents the usage of PowerShell cmdlets and command-line tools for web-based data retrieval, often leveraged by attackers for stage-two payload delivery or data exfiltration.

This brief documents a detection capability for identifying potential command-and-control activity where adversaries use PowerShell to test network connectivity over non-standard, uncommon ports.

Adversaries utilize PowerShell to store malicious payloads within NTFS Alternate Data Streams (ADS) to evade detection and maintain stealthy persistence.

Adversaries perform reconnaissance on Windows service registry keys using PowerShell to identify weak permissions susceptible to service hijacking and privilege escalation.

Detection of the default named pipe used by the RemCom remote administration tool, which is frequently leveraged by attackers for lateral movement and remote command execution.

Detection of suspicious network activity where Windows script interpreters (Wscript.exe and Cscript.exe) initiate connections to local IP ranges.

This detection targets anomalous network connections over WinRM ports 5985 and 5986 that originate from non-network service accounts, a common indicator of unauthorized remote PowerShell execution or lateral movement.

Detection of RDP traffic (TCP 3389) initiated by unauthorized or non-standard binaries, which may indicate lateral movement or unauthorized remote access.

PsExec leaves a distinct file-system artifact on target systems during service execution that can be used to detect lateral movement.

Detection of Windows shell and scripting applications writing files to common staging directories used by threat actors for persistence and lateral movement.

Adversaries utilize NTFS Alternate Data Streams (ADS) to conceal malicious executables, effectively bypassing basic file visibility checks and traditional security scans.

This brief documents the detection of file restoration events from the Microsoft Defender quarantine, a technique that can be leveraged by attackers to re-enable malicious payloads.

Detection of administrative or malicious modifications to Windows Defender settings that add file or path exclusions to the antimalware scanning engine.

Adversaries utilize the Background Intelligent Transfer Service (BITS) to execute or stage malicious payloads from uncommon or suspicious remote domains to evade detection.

Detection of MSIX/AppX package installations requesting full trust capabilities which circumvent standard application container isolation and operate with elevated privileges.

Adversaries are leveraging the Windows AppX deployment mechanism to execute malicious packages by placing them in non-standard file paths to bypass traditional deployment directory restrictions.

Adversaries can achieve persistence and privilege escalation by modifying the Winlogon Notify registry key to trigger the execution of arbitrary DLLs during user login.

Adversaries modify the WDigest UseLogonCredential registry key to downgrade credential protection and enable the storage of clear-text passwords in memory for exfiltration via LSASS.

An adversary or unauthorized user modifies the Windows registry to disable the UAC secure desktop prompt, reducing security by allowing UAC elevation requests to appear on the user's desktop where they may be intercepted by malicious processes.

Detection of attackers suppressing Windows User Account Control (UAC) prompts by modifying the UACDisableNotify registry value to facilitate unauthorized system changes.

Detection of attackers attempting to disable Windows User Account Control (UAC) via registry manipulation to bypass privilege escalation protections.

Adversaries leverage the COM TreatAs registry key to achieve persistence or privilege escalation by redirecting CLSID lookups to malicious COM objects.

Adversaries modify Windows Registry keys to disable Windows Security Center notifications, facilitating defense impairment and persistence.