Product
Wireless Credential Dumping via Netsh
2 rules 2 TTPsAdversaries use the Windows built-in utility Netsh to dump Wireless saved access keys in clear text, potentially leading to credential compromise.
Persistence via BITS Job Notify Cmdline
2 rules 1 TTPAdversaries can achieve persistence by abusing the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program after a job finishes, leading to arbitrary code execution and system compromise.
PowerShell Script Block Logging Disabled via Registry Modification
2 rules 2 TTPsAttackers may disable PowerShell Script Block Logging by modifying the registry to conceal their activities on the host and evade detection by setting the `EnableScriptBlockLogging` registry value to 0, impacting security monitoring and incident response capabilities.
Process Execution from Suspicious Windows Directories
2 rules 1 TTPAdversaries may execute processes from unusual default Windows directories to masquerade malware and evade defenses by blending in with trusted paths, making malicious activity harder to detect.
Potential Defense Evasion via Filter Manager (fltMC.exe)
2 rules 1 TTPAdversaries may abuse the Filter Manager Control Program (fltMC.exe) to unload filter drivers, thereby evading security software defenses such as malware detection and file system monitoring.
Network Logon Provider Registry Modification
2 rules 2 TTPsAdversaries may modify the network logon provider registry to register a rogue network logon provider module for persistence and credential access by intercepting authentication credentials in clear text during user logon.