Skip to content
Threat Feed
Subscribe

Product

CrowdStrike Falcon

5 briefs RSS
high advisory

Privilege Escalation via Named Pipe Impersonation

Adversaries may escalate privileges by abusing named pipe impersonation, a technique often used with tools like Metasploit's meterpreter getsystem command, where a process writes to a named pipe to facilitate a SYSTEM-token handoff.

Microsoft Defender XDR +4 privilege-escalation named-pipe windows
2r 1t
medium advisory

Remote Desktop File Opened from Suspicious Path

Adversaries may abuse RDP files delivered via phishing from suspicious locations to gain unauthorized access to systems.

M365 Defender +4 initial-access rdp phishing windows
2r 2t
low advisory

Netsh Helper DLL Persistence

Attackers may abuse the Netsh Helper DLL functionality by adding malicious DLLs to execute payloads every time the netsh utility is executed via administrators or scheduled tasks, achieving persistence.

Microsoft Defender XDR +3 persistence windows netsh registry
2r 2t
high advisory

Suspicious Microsoft Antimalware Service Executable Execution

Detects suspicious execution of the Microsoft Antimalware Service Executable (MsMpEng.exe) from non-standard paths or renamed instances, which may indicate an attempt to evade defenses through DLL side-loading or masquerading.

Microsoft Antimalware Service Executable +6 defense-evasion execution windows
3r 1t
low advisory

Adding Hidden File Attribute via Attrib.exe

Adversaries can use attrib.exe to add the 'hidden' attribute to files to hide them from users and evade detection, which can be detected by monitoring process executions related to attrib.exe.

M365 Defender +4 defense-evasion persistence windows attrib.exe
2r 2t