Detection

Adversaries leverage the Telegram desktop application on Windows to download malicious payloads and secondary tools by monitoring for associated file stream creation events.

Cisco AI Defense alerts indicate potential iterative prompt injection or unauthorized data exfiltration attempts against generative AI applications, characterized by bursts of high-risk guardrail violations.

This detection monitors PowerShell Script Block Logging (EventCode 4104) to identify patterns indicative of credential theft, lateral movement, and persistence used by offensive toolkits.

Detection of unauthorized modifications to Windows registry autostart keys, a common technique used by threat actors to maintain persistence across system reboots.

This brief details a detection strategy for identifying non-browser User-Agent strings in web access logs, which often indicate reconnaissance, automated scanning, or exploitation attempts using scripting languages and security tools.

This detection analytic identifies suspicious PowerShell activity by monitoring command-line strings for patterns associated with known offensive security toolkits used for credential theft, lateral movement, and persistence.

This analytic identifies potential unauthorized access or credential misuse by detecting API calls performed by AWS 'AssumedRole' entities that deviate from historical behavioral baselines.

Attackers frequently create new local user accounts on Linux systems to establish and maintain persistence following initial compromise.

This brief describes the detection of unauthorized access to the LSASS process handle via OpenProcess, OpenThread, and ReadProcessMemory API calls, a technique used by adversaries to facilitate credential dumping.

Cisco Talos has documented the emergence of malware leveraging LLM services and local inference, introducing the CAIRN framework to track these threats via metadata-based cognitive artifacts.

Adversaries leverage 'for /f' loops within 'cmd.exe' to programmatically extract and process data from system command outputs for discovery and post-exploitation tasks.

This detection brief identifies potential data exfiltration or unauthorized collection by monitoring for unusual AWS DynamoDB Scan operations performed by users or roles exhibiting non-typical behavior.

Adversaries utilize the DNSExfiltrator tool to tunnel file data through covert DNS requests, bypassing traditional network egress filtering.

This brief documents patterns in file naming conventions frequently associated with attacker toolkits, proof-of-concept exploits, and red team frameworks.

Detection engineering brief covering the identification of malicious PowerShell scripts leveraging Windows API calls for process injection, token manipulation, and in-memory execution.

This brief documents detection signatures for the Nishang offensive PowerShell framework, a collection of scripts used for post-exploitation, lateral movement, and credential theft.

This detection brief identifies common malicious PowerShell command line patterns that utilize Base64 encoded arguments frequently observed in malware infection stages.

Detection of Kubernetes pod execution requests containing suspicious socket and shell redirection patterns indicative of post-exploitation reverse shell establishment.

This detection brief monitors Linux hosts for the use of standard system utilities and scripting interpreters to decode Base64 data, a common technique employed by adversaries to obfuscate malicious payloads and command-and-control traffic.

This brief describes a detection opportunity for the stealthy creation of the 'PSScriptPolicyTest' PowerShell script by processes other than standard PowerShell executables or legitimate Windows components, a behavior potentially indicative of advanced adversaries attempting to bypass PowerShell logging and security policies.

Adversaries leverage the Windows %startup% folder to establish persistence by creating malicious files that execute automatically upon system boot or user logon, potentially leading to system compromise and unauthorized access.

This threat brief details how Linux systems making DNS queries to commonly abused top-level domains may indicate malware-related command and control (C2) communications, data exfiltration, or payload downloads, often blending into normal name resolution, signaling a potential compromise of servers, workstations, or containerized workloads.

This brief details the detection of unencrypted Telnet traffic on its default port 23, a legacy protocol commonly used for remote administration but frequently exploited by threat actors for initial access or as a backdoor due to its plain-text nature, which exposes sensitive information and facilitates unauthorized access.

This brief details a detection strategy for suspicious network connections originating from processes located in uncommon or typically protected Windows file system directories, often indicative of malware establishing command and control or exfiltrating data.

This brief details a detection strategy for malicious actors attempting to establish persistence or elevate privileges by creating a Process Monitor driver file (`.sys`) from an unauthorized process, indicating potential kernel-level compromise on Windows systems.

This brief details the detection of `SeLoadDriverPrivilege` usage on Windows systems, a critical privilege enabling attackers to load malicious kernel drivers for advanced defense evasion and privilege escalation, leading to full system compromise.

This brief describes the detection of web shells by antivirus solutions, emphasizing the importance of investigating these alerts as they signify a compromised web server and potential post-exploitation activity by an attacker.

This brief details a Sigma rule designed to detect Antivirus alerts flagging various malicious Remote Access Tools (RATs) such as AgentTesla, AsyncRAT, and NanoCore, highlighting the critical need for investigation into the initial infection vector even when the AV blocks the threat.

This brief describes the detection of highly relevant antivirus alerts specifically flagging hacktools or other attack tools via distinct signatures, indicating the presence of offensive security utilities or malicious software on endpoints, which requires immediate investigation despite the AV's block action.

This brief details a detection rule for critical antivirus alerts that report Advanced Persistent Threat (APT) malware signatures, enabling detection engineers to identify and investigate sophisticated threats that have reached endpoints.

This brief details the detection of new local user creation on Fortinet FortiGate firewalls, a behavior often leveraged by adversaries for persistence and unauthorized VPN access, underscoring a critical post-exploitation activity for detection engineers.

This brief details a detection analytic for the creation of executables or scripts, such as .exe, .dll, or .ps1 files, in suspicious Windows file paths like `\windows\fonts\` or `\users\public\`, a technique frequently employed by adversaries for defense evasion and persistence, potentially leading to unauthorized code execution and privilege escalation.

Poorly chosen performance metrics can significantly impair a SOC's ability to detect and respond to threats, leading to ineffective security operations and potential compromise.