Skip to content
Threat Feed
Subscribe

Tag

Lolbins

6 briefs RSS
high advisory

Stealthy KongTuke C2 Discovered via Multi-Domain Threat Hunting

Unspecified adversaries are using a Traffic Direction System (TDS) redirect for initial access, followed by encoded PowerShell execution to download payloads like `script.ps1` into the `ApplicationData` directory, and establishing command-and-control (C2) communication via `curl.exe` to suspicious IP addresses such as `144.31.221.82` with defense evasion techniques like post-execution cleanup, designed to operate below traditional detection thresholds.

command-and-control defense-evasion execution powershell lolbins threat-hunting
3r 8t 2i
low advisory

Suspicious Windows Process Cluster Detected from Parent Process

A machine learning job has identified a parent process spawning one or more suspicious Windows processes exhibiting unusually high malicious probability scores, indicating potential defense evasion tactics like masquerading and LOLBins usage.

Elastic Endpoint +2 defense-evasion windows ml lolbins
2r 2t
low advisory

Unusual Process Spawned by a Host via Machine Learning

A machine learning job detects unusual Windows processes, potentially Living off the Land binaries, on hosts not commonly associated with malicious activity, indicating possible defense evasion attempts.

Elastic Defend +1 defense-evasion lolbins machine learning windows
2r 1t
low advisory

Unusual Process Spawned by a Parent Process via Machine Learning

A machine learning job detected a suspicious Windows process, predicted malicious by the ProblemChild model and flagged as an unusual child process name for its parent, potentially indicating LOLbins usage and evading traditional detection.

defense-evasion lolbins windows machine-learning
2r 2t
low advisory

Suspicious Windows Process Cluster Detection via Machine Learning

A machine learning job combination has identified a host with one or more suspicious Windows processes that exhibit unusually high malicious probability scores, potentially indicating masquerading and defense evasion tactics.

defense-evasion masquerading LOLbins windows
2r 2t
low advisory

Unusual Process Spawned by a User Detected by Machine Learning

A machine learning job detected a suspicious Windows process, predicted to be malicious by the ProblemChild supervised ML model and found to be unusual within the user's context, potentially indicating defense evasion techniques like masquerading or the use of LOLbins.

endpoint windows defense evasion machine learning lolbins
2r 2t