Endpoint-Detection

This brief details a detection strategy for identifying the introduction of remote monitoring and management (RMM) software in Windows environments by monitoring for newly observed code-signing certificates.

This analytic identifies ransomware activity by detecting file creation or modification events on endpoint filesystems where the resulting file extensions match known ransomware patterns, potentially leading to significant data loss and operational disruption.

An Elastic machine learning rule detects rare and unusual DNS queries that indicate potential malicious network activity, including initial access via phishing or malicious documents, persistence, command-and-control (C2) communication, or data exfiltration attempts by adversaries.

This detection identifies the malicious use of 'rclone', a legitimate file synchronization utility, for data exfiltration or cloud abuse by flagging `rclone.exe` execution when specific suspicious command-line arguments are used, such as those indicating synchronization to remote cloud storage providers like `mega:`, `ftp:`, or generic `remote:`, especially in conjunction with flags like `--transfers`, `--ignore-existing`, or `--auto-confirm`, which is a critical indicator of compromise abused by threat actors for stealthy data exfiltration.

This analytic detects the execution of tools commonly used by attackers for activities such as unauthorized access, network scanning, privilege escalation, password dumping, or data exfiltration, leveraging process activity data from Endpoint Detection and Response (EDR) agents to identify known attacker tool names.

Adversaries commonly use Wscript or Cscript to launch suspicious child processes, including LOLBINs and scripting interpreters, as a defense evasion and execution technique, which can lead to further system compromise or data destruction.

This brief identifies suspicious Command and Control (C2) activity on Linux systems where a C2 agent, such as Poseidon or Athena, connects outbound from a sensitive temporary directory and subsequently creates a file in a similar location, indicative of receiving and executing commands from a C2 framework like Mythic.

This brief describes a detection for suspicious activity on Windows systems where an uncommon or unauthorized process attempts to access browser user data profiles, a common behavior observed in Trojan Stealers like SnakeKeylogger to harvest sensitive browser information and credentials for exfiltration.