Post-Exploitation

Threat actors are utilizing the CyberStrikeAI framework to automate post-exploitation tasks, including reconnaissance and lateral movement, through a server-side LLM orchestrator and a Golang-based C2 implant.

Adversaries utilize command-line utilities like 'dir' and 'findstr' to locate password manager databases and sensitive credential files to facilitate credential theft and privilege escalation.

Adversaries leverage the native Windows utility quser.exe to enumerate active RDP user sessions, a common reconnaissance technique observed in post-exploitation frameworks like winPEAS and ransomware campaigns.

Adversaries utilize the Windows native 'netsh.exe' utility to perform reconnaissance on firewall rules and network configurations to facilitate post-exploitation activities and security control bypass.

Attackers utilize the Windows built-in utility 'forfiles.exe' to execute commands against multiple files, a technique leveraged by the Prestige ransomware to facilitate post-exploitation file enumeration and malicious activity.

Adversaries leverage native macOS utilities such as smbutil and showmount to perform internal network reconnaissance by discovering available SMB and NFS shares.

This brief details methods used by attackers to harvest sensitive credentials from macOS Keychain databases using native utilities or direct file access.

Attackers utilize the net.exe utility to create or delete Windows shares as a mechanism for lateral movement, data exfiltration, and establishing persistence.

This detection monitors PowerShell Script Block Logging (EventCode 4104) to identify patterns indicative of credential theft, lateral movement, and persistence used by offensive toolkits.

This analytic identifies the use of suspicious named pipes on Windows systems, a technique commonly leveraged by malware and post-exploitation frameworks for inter-process communication.

Adversaries are abusing the legitimate AWS IoT Secure Tunneling localproxy binary in destination mode to establish unauthorized remote access tunnels through AWS-managed infrastructure.

Adversaries may abuse the macOS osascript utility to execute interactive shell commands for persistence or post-exploitation activities by invoking bash with interactive flags.

Adversaries abuse the macOS osascript utility to execute JavaScript for Automation (JXA) combined with Objective-C bridges to perform post-exploitation activity on macOS systems.

Adversaries leverage the socat utility to establish bind shells or facilitate remote command execution by binding executables to network listeners, a technique increasingly observed in macOS post-exploitation scenarios.

Adversaries leverage 'osascript' and 'osacompile' utilities on macOS to execute shell commands or stage malicious AppleScript payloads via the 'do shell script' command.

Adversaries utilize native Windows utilities like cmd.exe and findstr.exe to search for sensitive private key files, a common post-exploitation technique used to facilitate credential theft, privilege escalation, and persistence.

Adversaries utilize the Mimikatz post-exploitation framework to dump credentials and perform authentication abuse by executing specific command-line modules in Windows environments.

Detection engineering brief covering common command-line execution patterns generated by the CrackMapExec (CME) post-exploitation framework during lateral movement and command execution.

PowerView is an open-source PowerShell module frequently used by threat actors for domain reconnaissance, user enumeration, and identifying lateral movement opportunities.

This brief documents detection signatures for the Nishang offensive PowerShell framework, a collection of scripts used for post-exploitation, lateral movement, and credential theft.

This brief documents a comprehensive list of commandlet patterns associated with common PowerShell-based exploitation frameworks, privilege escalation tools, and post-exploitation modules used by threat actors.

Adversaries, including those using the PANIX post-exploitation framework, are abusing XDG autostart directories on Linux to achieve persistence via malicious .desktop files.

Detection of unauthorized system shell and utility execution originating from Redis server processes indicative of post-exploitation activity or sandbox escapes like CVE-2022-0543.

Detection of malicious actors accessing sensitive shell history files using common command-line utilities to harvest credentials or reconnaissance data on compromised Linux hosts.

This brief addresses the detection of the 'id' command executed by the root user on Linux systems, a behavior frequently utilized by attackers for situational awareness during post-exploitation and privilege escalation verification.

This brief details the detection of suspicious outbound network connections initiated by Netcat (nc, ncat) utilities on Linux systems, which are frequently used by threat actors for C2 communication and data exfiltration.

Detection of root-level execution of binaries from volatile shared memory directories (/dev/shm/ and /run/shm/) used by threat actors for fileless persistence and forensic evasion.

A SigmaHQ detection rule identifies suspicious processes accessing Windows credential manager and vault files, potentially indicating credential theft by tools like Mimikatz, enabling lateral movement and data exfiltration.

Attackers compromise web servers (Apache, Nginx, Tomcat, PHP) and leverage them to make unexpected outbound network connections to public file-sharing or content hosting services, indicating post-exploitation activity for ingress tool transfer and further compromise.

This analytic detects the execution of tools commonly used by attackers for activities such as unauthorized access, network scanning, privilege escalation, password dumping, or data exfiltration, leveraging process activity data from Endpoint Detection and Response (EDR) agents to identify known attacker tool names.

This brief details a high-severity Linux privilege escalation technique where an attacker, having gained initial access, drops an exploit in a user- or world-writable directory, executes it as a non-root user, and the resulting child process changes its effective user ID to root (UID 0), thereby achieving full system compromise.

Threat actors utilize built-in Windows utilities like whoami, wmic, and net to perform local account and system owner discovery, a common post-exploitation reconnaissance technique facilitating privilege escalation and lateral movement.

This brief details a detection strategy for identifying the use of renamed Sysinternals utilities by monitoring for suspicious modifications to the 'EulaAccepted' registry key, indicating potential post-exploitation activity or defense evasion on Windows systems.

This brief details a detection for potentially suspicious `GrantedAccess` flags when a process attempts to access `LSASS.exe`, indicating possible credential dumping attempts by adversaries, which can lead to lateral movement and privilege escalation on Windows systems.

Adversaries frequently target the Local Security Authority Subsystem Service (LSASS) process on Windows systems to dump credentials, employing tools like Mimikatz, NanoDump, or Procdump to extract sensitive authentication material for lateral movement and persistence.

This brief describes the detection of suspicious access mask requests to the Local Security Authority Subsystem Service (LSASS) process, a common post-exploitation technique used by threat actors for credential dumping on Windows systems.

This brief describes the detection of highly relevant antivirus alerts specifically flagging hacktools or other attack tools via distinct signatures, indicating the presence of offensive security utilities or malicious software on endpoints, which requires immediate investigation despite the AV's block action.

This brief describes the detection of adversaries leveraging the `Get-Clipboard` PowerShell commandlet, identified through PowerShell Script Block Logging (EventCode 4104), to steal sensitive information such as credentials or PII from the Windows clipboard during the collection phase of an attack, potentially leading to unauthorized access and further compromise.

This analytic identifies potential post-exploitation behaviors on a Windows system by monitoring multiple risk events and their associated MITRE ATT&CK tactics, indicating potential malicious actions following an initial compromise.

This brief covers the detection of NetExec, a post-exploitation and lateral movement tool, through monitoring for unique file creation patterns associated with its execution and file extraction in Windows environments.

The threat brief details the detection of NetExec (formerly CrackMapExec), a post-exploitation tool used for Active Directory penetration testing and network enumeration, often employed by threat actors for lateral movement and credential harvesting.

This brief documents the detection of the WinPEAS PowerShell script execution on Windows systems, a tool commonly used for identifying privilege escalation paths by identifying specific function names used within the script.

Detection of Windows Management Instrumentation Command-line (WMIC) usage for reconnaissance by querying common Win32 WMI classes for system information, potentially indicating post-exploitation activity.

This brief covers the detection of adversaries using native Windows commands like `wmic qfe`, `systeminfo`, and `hostname` to gather system information for further exploitation.