Threat briefs

Adversaries, including those using Amadey malware, utilize Windows utilities like icacls.exe to modify file permissions, facilitating defense evasion and persistence by hindering security analysis.

Attackers utilize the PowerView 'Invoke-ShareFinder' PowerShell cmdlet to discover network file shares, potentially exposing sensitive data for lateral movement and privilege escalation.

Attackers utilize the Image File Execution Options (IFEO) registry key to intercept process execution and achieve persistence or evasion by attaching a debugger to legitimate Windows binaries.

Attackers often terminate the Windows Event Log service, documented via Event ID 1100, to disrupt auditing and obscure malicious post-exploitation activities.

Detection of Windows Security Event ID 1102 or System Event ID 104 indicates an attempt to disrupt forensic logging and cover tracks after system compromise.

This brief covers the detection of modifications to privileged Active Directory groups, potentially linked to the exploitation of CVE-2024-37085, where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.

Adversaries leverage the Deployment Image Servicing and Management (DISM) tool to disable or remove Windows Defender components as a defense evasion technique.

Attackers, particularly ransomware operators, modify Windows Registry keys to disable critical system features and security configurations, hindering forensic response and maintaining persistence.

Malware families, including Remote Access Trojans (RATs), modify Windows registry keys to disable the Notification Center, effectively suppressing system alerts to hide malicious activity.

Adversaries, specifically ransomware operators, modify Windows Registry keys to disable the logoff button, hindering incident response and forcing session persistence.

Threat actors and ransomware operators modify the Windows Registry to disable the workstation lock feature, ensuring persistent access and preventing user interference during malicious operations.

Attackers, particularly ransomware actors, modify the Windows registry to disable the Change Password feature, preventing users from regaining control of their accounts and impeding incident response.

Attackers are utilizing createdump.exe, a utility often bundled with third-party software like PowerShell 7, to dump LSASS memory for credential theft.

This analytic identifies attackers attempting to establish persistence or escalate privileges by using net.exe to add users to local administrator groups.

Detection of unauthorized local user account creation on Windows systems via event ID 4720, a technique frequently leveraged by threat actors for persistence and privilege escalation.

The execution of the ConvertTo-AADIntBackdoor PowerShell cmdlet indicates an attempt to compromise Azure AD federation settings to enable unauthorized token generation and persistent access.

APT37 leverages the native Windows expand.exe utility to extract malicious CAB archives into common staging directories like C:\ProgramData as a precursor to persistence and execution.

Attackers are abusing the native Windows binary mavinject.exe to perform arbitrary DLL injection into running processes, enabling stealthy code execution and persistence.

Adversaries manipulate undocumented registry keys under the NTDS service to load malicious DLLs into the Local Security Authority Subsystem Service (LSASS) for credential theft and persistence.

Attackers can bypass application whitelisting policies by leveraging rundll32.exe to execute arbitrary code through specific Windows library functions, facilitating persistence and privilege escalation.

Threat actors, including Wizard Spider and FIN6, frequently abuse the legitimate AdFind.exe utility to perform unauthorized Active Directory reconnaissance to facilitate lateral movement and privilege escalation.

Attackers may reset the Directory Services Restore Mode (DSRM) administrator password on Domain Controllers to maintain persistent, high-privileged administrative access.

Attackers utilize the native Windows utility wbadmin.exe to delete system backups and catalogs as part of ransomware operations to impede victim recovery.

Detection of the deletion of the Windows Update Sequence Number (USN) Journal using the fsutil.exe utility to identify attempts by adversaries to hinder forensic investigations.

Adversaries utilize PowerShell commands to query environment variables as part of local system reconnaissance to identify the current logged-in user.

Adversaries utilize the fltMC.exe utility to unload the Sysmon filter driver, effectively blinding security monitoring and suppressing telemetry generation to facilitate further malicious activity.

Adversaries utilize the Windows utility 'query.exe' to perform system and Active Directory user discovery for situational awareness, facilitating further lateral movement and privilege escalation.

An analytic for identifying system information discovery techniques, including the execution of wmic, systeminfo, and hostname, used by attackers to profile target environments.

Detection of rundll32.exe executing with 'Start' or 'StartW' function parameters, a common technique used by Cobalt Strike payloads to achieve arbitrary code execution and persistence.

Detection of reg.exe execution spawned via non-interactive command prompts to identify unauthorized registry modifications associated with persistence or defense evasion.