Threat briefs

This detection focuses on identifying suspicious child processes spawned from 'mshta.exe', a common living-off-the-land technique used by threat actors like Lumma Stealer and MuddyWater for code execution and persistence.

The Microsoft Workflow Compiler (microsoft.workflow.compiler.exe) is being abused as a living-off-the-land technique to execute arbitrary code or maintain persistence via proxy execution.

This detection targets the suspicious lifecycle of Windows user accounts created and deleted within one hour, a technique often used by attackers to gain ephemeral unauthorized access or maintain persistence while evading long-term detection.

Attackers are abusing the Windows Application Compatibility Shim infrastructure via sdbinst.exe to intercept API calls, achieve persistence, and escalate privileges.

Attackers can use Application Compatibility Database (.sdb) files to intercept API calls, allowing for privilege escalation and persistence by bypassing Windows security controls.

Adversaries utilize schtasks.exe with remote command-line arguments to establish persistence or facilitate lateral movement across Windows environments.

This brief describes the detection of adversaries abusing 'schtasks.exe' for lateral movement and remote code execution by triggering scheduled tasks on remote Windows endpoints.

Adversaries frequently use schtasks.exe via command interpreters to establish persistence or execute malicious payloads; this detection monitors for abnormal task creation or deletion originating from non-system processes.

Adversaries leverage the rundll32.exe utility to execute malicious DLL export functions by ordinal value, a technique designed to evade standard process monitoring and security controls.

Threat actors deploying ransomware such as CLOP, BlackByte, and Medusa manipulate Windows shadow storage volumes using vssadmin.exe to prevent data recovery.

Detection of WMIC.exe utilization with the node switch, a living-off-the-land technique used by threat actors for lateral movement and remote code execution.

Adversaries and Red Teams utilize the [adsisearcher] PowerShell type accelerator to perform Active Directory reconnaissance by querying for domain computer objects.

Adversaries leverage the Windows Management Instrumentation (WMI) utility (wmic.exe) to facilitate lateral movement and remote code execution by spawning unauthorized processes on target systems.

Adversaries, including operators of Remcos and njRAT, utilize the Regsvr32 utility with silent and install parameters to load malicious DLLs for code execution and persistence.

Adversaries can abuse the Windows Application Compatibility Shim (AppCompatFlags) mechanism by modifying specific registry keys to achieve persistence, escalate privileges, or bypass security controls.

Detection of unauthorized or suspicious process spawning from WmiPrvSE.exe, a common technique for lateral movement, remote code execution, and persistence via Windows Management Instrumentation.

Adversaries abuse the PowerShell Start-BitsTransfer cmdlet to facilitate file transfers, enabling clandestine data exfiltration and payload delivery via the Background Intelligent Transfer Service (BITS).

This brief details the detection of potential lateral movement and remote code execution via the abuse of 'New-CIMSession' and 'Invoke-CIMMethod' cmdlets in PowerShell.

The execution of Get-LocalGroup via PowerShell or cmd.exe is a common discovery technique used by attackers to map local group memberships for privilege escalation.

This brief covers the detection of adversarial abuse of PowerShell COM object instantiation via GetTypeFromCLSID, a technique used for UAC bypass and privilege escalation by threat actors including ransomware operators.

Detection of the Enable-PSRemoting cmdlet usage via PowerShell Script Block logging, which attackers often employ to establish remote access and enable lateral movement within a compromised environment.

Attackers utilize PowerShell to modify or add InProcServer32 registry keys to facilitate COM hijacking, enabling arbitrary code execution, persistence, or privilege escalation.

Adversaries modify or replace Windows accessibility binaries such as sethc.exe and utilman.exe to establish persistence and bypass authentication mechanisms for unauthorized system access.

Adversaries leverage nltest.exe to enumerate Active Directory domain trust relationships, facilitating lateral movement and network reconnaissance in post-compromise environments.

Adversaries leverage native macOS utilities such as smbutil and showmount to perform internal network reconnaissance by discovering available SMB and NFS shares.

Adversaries may enumerate macOS application firewall settings using legitimate binaries to identify security restrictions and potential network attack surfaces.

This brief details methods used by attackers to harvest sensitive credentials from macOS Keychain databases using native utilities or direct file access.

Adversaries leverage xattr and spctl utilities to bypass MacOS Gatekeeper protections, enabling the execution of untrusted or malicious binaries.

The Awfulshred wiper malware exploits the Linux System Request (SysRq) mechanism to force an immediate system reboot by writing to the proc/sysrq-trigger interface.

Adversaries perform network reconnaissance on Linux systems by rapidly enumerating network configuration and firewall settings, which this analytic detects via a 30-minute window of process execution telemetry.