Tag
File Creation in World-Writable Directory by Unusual Process
2 rules 1 TTPThis rule detects the creation of files in world-writable directories on Linux systems by an unusual process, which is a common defense evasion tactic for potential lateral movement or malicious payload staging.
Suspicious Alternate Data Stream (ADS) File Creation
2 rules 1 TTPDetects suspicious creation of Alternate Data Streams (ADS) on targeted files using script or command interpreters, indicative of malware hiding in ADS for defense evasion.
Executable or Script Creation in Temporary Paths
2 rules 1 TTPAdversaries may create executables or scripts in temporary directories to evade detection, maintain persistence, and execute unauthorized code on Windows systems.
WScript or CScript Dropper
2 rules 2 TTPsThe WScript or CScript Dropper technique involves using cscript.exe or wscript.exe to write malicious script files (js, jse, vba, vbe, vbs, wsf, wsh) to suspicious locations on a Windows system for later execution.