Product
Remote Desktop File Opened from Suspicious Path
2 rules 2 TTPsAdversaries may abuse RDP files delivered via phishing from suspicious locations to gain unauthorized access to systems.
Netsh Helper DLL Persistence
2 rules 2 TTPsAttackers may abuse the Netsh Helper DLL functionality by adding malicious DLLs to execute payloads every time the netsh utility is executed via administrators or scheduled tasks, achieving persistence.
Windows Backup Deletion via Wbadmin
2 rules 2 TTPsAdversaries may delete Windows backup catalogs and system state backups using wbadmin.exe to inhibit system recovery, often as part of ransomware or other destructive attacks.
Suspicious Microsoft Antimalware Service Executable Execution
3 rules 1 TTPDetects suspicious execution of the Microsoft Antimalware Service Executable (MsMpEng.exe) from non-standard paths or renamed instances, which may indicate an attempt to evade defenses through DLL side-loading or masquerading.
Persistence via WMI Event Subscription
2 rules 2 TTPsAdversaries can leverage Windows Management Instrumentation (WMI) to establish persistence by creating event subscriptions that trigger malicious code execution when specific events occur, using tools like wmic.exe to create event consumers.
Adding Hidden File Attribute via Attrib.exe
2 rules 2 TTPsAdversaries can use attrib.exe to add the 'hidden' attribute to files to hide them from users and evade detection, which can be detected by monitoring process executions related to attrib.exe.