Threat briefs

Adversaries leverage the .NET WindowsIdentity.GetCurrent() method via PowerShell to perform system owner discovery, aiding in situational awareness and lateral movement.

This detection monitors for the execution of Get-WMIObject Win32_Group via PowerShell Script Block Logging to identify potential reconnaissance activity associated with group enumeration.

This detection identifies the execution of the Get-ForestTrust PowerShell command, which adversaries use to map Active Directory forest trust relationships for lateral movement and privilege escalation.

Adversaries utilize the Get-DomainUser cmdlet within the PowerView framework to perform Active Directory reconnaissance and user enumeration.

Adversaries utilize the PowerView PowerShell module's Get-DomainTrust command to perform Active Directory reconnaissance, facilitating lateral movement planning by mapping domain trust relationships.

Attackers utilize the legitimate Windows utility esentutl.exe to perform unauthorized copies of the SAM and ntds.dit files for offline credential extraction, facilitating privilege escalation and lateral movement.

Detection of the UseLogonCredential registry modification used to enable plaintext credential storage in Windows memory for post-exploitation credential dumping.

Adversaries utilize the legitimate Sysinternals utility procdump.exe to extract sensitive credentials from the LSASS process memory to facilitate lateral movement and privilege escalation.

Adversaries leverage the legitimate comsvcs.dll library to dump the LSASS process memory via rundll32.exe, enabling unauthorized credential extraction from Windows systems.

Adversaries leverage the native Windows utility dsquery.exe to map Active Directory domain trusts, facilitating lateral movement and privilege escalation.

Threat actors, including those deploying Remote Access Trojans such as NjRAT, modify Windows Registry keys to disable System Restore and hinder recovery efforts.

Malware and threat actors modify Windows registry keys to disable the Command Prompt (cmd.exe) as a defense evasion tactic to hinder incident response and system remediation.

Malware, including ransomware and RATs, frequently modifies Windows registry keys to disable Defender real-time protection to facilitate unhindered post-exploitation activity.

Attackers and malware frequently modify the Windows registry to disable the Registry Editor, preventing incident responders from manually removing malicious persistence mechanisms.

Adversaries, particularly ransomware operators, use the Windows built-in tool wevtutil.exe to disable security event logs, effectively blinding detection systems and hindering forensic investigation.

Attackers modify registry keys to disable Event Tracing for Windows (ETW), effectively blinding security telemetry and facilitating defense evasion.

SharpHound is a widely used tool for Active Directory enumeration, enabling attackers to perform reconnaissance, map network relationships, and identify paths for lateral movement and privilege escalation.

Attackers utilize the SharpHound tool for automated Active Directory enumeration to map network structures and identify targets for lateral movement and privilege escalation.

Adversaries leverage rundll32.exe with inline protocol handlers like VBScript or JavaScript to execute fileless payloads and bypass security controls.

Attackers abuse the trusted Microsoft Regsvr32 utility to proxy malicious code execution via 'scrobj.dll', a technique commonly known as 'Squiblydoo' used to bypass application control.

The execution of PsExec with the 'accepteula' flag is a common indicator of unauthorized remote code execution and lateral movement activity by threat actors.

Attackers exploit unquoted service paths on Windows systems to achieve privilege escalation by placing malicious executables in directories that the Windows Service Controller inadvertently executes with system-level privileges.

Attackers abuse the legitimate Windows mshta.exe utility to execute malicious scripts via inline protocol handlers to bypass security controls and achieve code execution.

Attackers abuse the Microsoft HTML Help utility (hh.exe) to execute arbitrary code or scripts by loading malicious Compiled HTML Help (CHM) files via InfoTech Storage Handlers.

Detection of unauthorized deletion of Volume Shadow Copies using native Windows utilities vssadmin.exe or wmic.exe, a common technique employed by ransomware actors to prevent system recovery.

Detection of attackers creating symbolic links to Volume Shadow Copies to bypass file system locks and access sensitive system files for credential theft.

Attackers frequently utilize the copy command to extract sensitive Windows credential files from Volume Shadow Copies to enable offline password cracking and privilege escalation.

Threat actors leverage native administrative tools such as WMIC and PowerShell to create Volume Shadow Copies, a technique used to facilitate credential dumping and offline password cracking.

Attackers utilize the net.exe utility to create or delete Windows shares as a mechanism for lateral movement, data exfiltration, and establishing persistence.

Threat actors may leverage curl with insecure flags within Kubernetes environments to bypass TLS certificate verification, facilitating man-in-the-middle attacks and unauthorized tool ingress.