Pua

This detection analytic identifies Potentially Unwanted Applications by monitoring for specific HTTP User-Agent strings in web logs, which can signify unauthorized tool usage or active compromise on the network.

This detection analytic identifies the creation or interaction with named pipes associated with potentially unwanted applications (PUAs) or administrative utilities that attackers leverage for lateral movement, command-and-control, or process injection.

Detection of the Nimgrab utility, a command-line tool often used for remote file downloads and potentially leveraged for stages of command-and-control operations.

This brief details a detection method for adversaries using renamed Sysinternals tools, a legitimate suite of utilities, to evade endpoint detection by triggering the `EulaAccepted` registry key creation, potentially leading to unauthorized system manipulation or data access on Windows systems.

Sophos X-Ops discovered that Hola Browser version 1.251.91.0 was distributed with an undeclared crypto-mining executable, me.exe, due to a supply chain compromise, leading to resource hijacking on affected Windows systems.