Skip to content
Threat Feed

Tag

Living-Off-the-Land

6 briefs RSS
high advisory

Crowdstrike RTR Script Execution via PowerShell

Detection of PowerShell execution initiated via Crowdstrike Real Time Response (RTR) 'runscript' command, potentially indicating malicious actors leveraging compromised Crowdstrike Dashboard access to execute commands on remote hosts using encoded commands.

Splunk Enterprise +3 living-off-the-land rtr script-execution
2r 1t
high advisory

Suspicious MSBuild Spawned by WMI Provider Process

The analytic identifies instances where wmiprvse.exe spawns msbuild.exe, an unusual process relationship indicative of potential COM object misuse and unauthorized code execution on Windows systems.

Splunk Enterprise +3 living-off-the-land defense-evasion msbuild
2r 1t
high advisory

Suspicious MSBuild Execution from Non-Standard Path

Detection of msbuild.exe execution from a non-standard path, indicating potential attempts to evade detection and execute malicious code.

Splunk Enterprise +2 msbuild lolbas living-off-the-land defense-evasion
3r 2t
medium advisory

Suspicious Microsoft Workflow Compiler Usage

The use of Microsoft Workflow Compiler (microsoft.workflow.compiler.exe), a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319, can indicate malicious intent such as code execution or persistence mechanisms, potentially leading to unauthorized access.

Splunk Enterprise +2 living-off-the-land proxy-execution endpoint
2r 1t
high advisory

Suspicious Microsoft Workflow Compiler Rename

Detection of the renaming of microsoft.workflow.compiler.exe, a technique used by attackers to evade security controls and potentially execute arbitrary code for privilege escalation or persistence.

Splunk Enterprise +3 lolbin defense-evasion living-off-the-land masquerading
3r 2t
high threat

Detection of Processes Launching netsh.exe for Malicious Purposes

Detection of netsh.exe execution by unusual processes indicative of potential malicious activity, including persistence and network configuration changes by threat actors.

exploited Splunk Enterprise +3 netsh living-off-the-land persistence network-configuration
2r