Product
Zoom-themed Phishing Campaign Delivering ConnectWise ScreenConnect
2 rules 5 TTPs 4 IOCsA phishing campaign impersonates Zoom to trick users into downloading and installing ConnectWise ScreenConnect, a legitimate remote monitoring and management tool, allowing attackers to gain persistent remote access, harvest credentials, and deploy secondary malware such as ransomware.
Command and Scripting Interpreter via Windows Scripts
2 rules 1 TTPThis rule detects the execution of PowerShell, PowerShell ISE, or Cmd spawned from Windows Script Host or MSHTA, indicating potential abuse of scripting interpreters to execute malicious commands or scripts on Windows systems.
Remote File Download via Script Interpreter
2 rules 3 TTPsAttackers are using Windows script interpreters (cscript.exe or wscript.exe) to download executable files from remote locations to deliver second-stage payloads or download tools.
Windows Script Execution from Archive File
2 rules 3 TTPsThis rule detects attempts to execute Jscript/Vbscript files from archive files, a common method for delivering malicious scripts by identifying unusual parent-child process relationships where scripting utilities are launched from archive programs, indicating potential exploitation.
Windows Script Host Executing PowerShell
2 rules 4 TTPsDetects PowerShell execution initiated by cscript.exe or wscript.exe, commonly used by attackers for initial access or payload delivery.