Stealth

Adversaries frequently leverage the C# compiler (csc.exe) to compile malicious code on-the-fly, often triggered by suspicious parent processes such as office applications or script engines.

Detection of suspicious file creation events where critical Windows system binaries write files with potentially malicious extensions, indicating potential process masquerading or system compromise.

Adversaries utilize PowerShell commands to modify file system metadata, specifically targeting creation, access, and modification timestamps to evade detection and hinder forensic analysis.

Adversaries utilize the PowerShell WindowStyle parameter to execute scripts in a hidden window, a technique often used to conceal malicious activity from user visibility.

Detection logic for PowerShell scripts utilizing the Start-Process cmdlet with the -PassThru parameter to execute processes in the background, a technique often used for stealthy execution.

Adversaries may use Hyper-V PowerShell cmdlets to create and manipulate virtual machines to conceal malicious activity or establish persistence.

This brief documents the use of .NET reflection techniques within PowerShell to execute arbitrary code in-memory, a method frequently utilized to bypass file-based security controls.

Adversaries utilize PowerShell commands to query WMI objects and check for virtualization artifacts to evade sandbox and analysis environments.

Adversaries frequently employ files with double extensions to bypass user skepticism and exploit Windows default settings that hide common file extensions.

Adversaries, such as the DripLoader malware, are abusing the lack of integrity checks in Electron applications to execute malicious native code via unsigned .node modules.

Adversaries frequently copy Living-off-the-Land Binaries (LOLBins) from protected system directories to arbitrary locations to evade security controls that rely on path-based allowlisting.

Adversaries may rename the legitimate createdump.exe utility to evade detection while performing unauthorized process memory dumps for credential access.

Detection of attackers using NTFS Alternate Data Streams (ADS) to hide and execute malicious PowerShell scripts, effectively bypassing simple file-based scanning.

This brief documents the use of the 'FromBase64String' method within PowerShell command lines, a common technique for obfuscating malicious payloads to bypass signature-based detection.

Detection of attackers using the Windows mshta.exe utility to execute malicious JavaScript code for living-off-the-land stealth execution.

Adversaries utilize NTFS Alternate Data Streams (ADS) to conceal malicious payloads and configuration data on Windows systems by appending information to existing files.

Adversaries often attempt to clear PowerShell command history to conceal malicious activities conducted during a security incident.

Detection of the execution of the Sysinternals Procdump utility, which is frequently used by attackers to dump process memory for credential access.

Attackers can abuse the NTFS $INDEX_ALLOCATION stream to create directories that are inaccessible to standard Windows utilities like Explorer and PowerShell, facilitating stealthy data storage.

Adversaries utilize NTFS Alternate Data Streams to hide and execute malicious payloads, evading detection by conventional file analysis tools.

Adversaries use the sc.exe utility to modify service security descriptors to achieve persistence, escalate privileges, or hide malicious services from standard management tools.

Adversaries may execute malicious payloads by leveraging rundll32.exe with non-standard file extensions to bypass simple filename-based security controls.

This brief documents common LOLBIN usage of rundll32.exe to execute arbitrary code or bypass security controls through legitimate Windows DLLs.

XORDump is a utility used by attackers to dump process memory, specifically targeting lsass.exe to facilitate credential theft.

Attackers can leverage the findstr.exe utility to download or read content from remote SMB shares using specific command-line arguments, potentially facilitating file exfiltration or second-stage payload delivery.

Attackers utilize the C# compiler (csc.exe) to dynamically compile and execute malicious code in memory, enabling evasion of signature-based defenses and EDR hooks.

Adversaries utilize PowerShell to store malicious payloads within NTFS Alternate Data Streams (ADS) to evade detection and maintain stealthy persistence.

Adversaries utilize NTFS Alternate Data Streams (ADS) to conceal malicious executables, effectively bypassing basic file visibility checks and traditional security scans.

Adversaries are leveraging the Windows AppX deployment mechanism to execute malicious packages by placing them in non-standard file paths to bypass traditional deployment directory restrictions.

Adversaries frequently modify Windows registry keys to prevent users from viewing hidden and system files, a technique used to maintain persistence and camouflage malicious artifacts.

This brief documents detection logic for PowerShell command-line obfuscation methods commonly utilized by the Invoke-Obfuscation framework to bypass security monitoring.

Adversaries may use PowerShell to open a handle to disk volumes via DOS device paths to perform direct, unauthorized file system access or bypass security controls.

Detection of common user-space applications being spawned under different user contexts, which often indicates privilege escalation testing or sacrificial process execution.

This brief describes a detection opportunity for the stealthy creation of the 'PSScriptPolicyTest' PowerShell script by processes other than standard PowerShell executables or legitimate Windows components, a behavior potentially indicative of advanced adversaries attempting to bypass PowerShell logging and security policies.

This brief detects an attacker's attempt to evade detection and maintain persistence by creating executable files with names identical to legitimate Windows system processes in non-standard directories, a tactic associated with stealth and defense evasion.

Threat actors are observed abusing the legitimate Windows utility rundll32.exe to execute malicious DLLs from remote UNC network paths, facilitating execution and lateral movement within compromised environments.

This brief describes the detection of Windows system binaries executing from uncommon locations, a defense evasion and stealth technique employed by various threat actors including Lazarus Group and Sidewinder APT, indicating potential malicious activity on an endpoint.

This brief details the Process Ghosting technique, an advanced evasion method leveraged by attackers to create and execute processes from files that no longer exist on disk, challenging traditional endpoint detection solutions and hindering forensic investigations.

This brief details the detection of a malicious AppX package downloaded from untrusted file-sharing or CDN domains, a technique employed by threat actors like BazarLoader to deliver malware via abused Windows app mechanisms, potentially leading to system compromise and ransomware.

Attackers are abusing the Linux shared memory directory, `/dev/shm`, for fileless malware staging and execution to evade disk-based detection mechanisms, posing a high risk for persistent access and system compromise.

This brief focuses on the detection of renamed Sysinternals ProcDump executables, a technique often employed by threat actors to evade security controls and perform credential dumping from LSASS memory on Windows systems, leading to potential lateral movement and privilege escalation.

This brief describes the detection of Living Off The Land Binaries (LOLBINs) and legitimate Windows applications being abused to drop various script files to disk, indicating malware staging or script-based code execution attempts.

This brief details a PowerShell defense evasion technique where adversaries utilize the `Start-Process` cmdlet with the `-PassThru` parameter to execute commands or programs in a hidden, background manner, enabling covert persistent access or malicious payload execution on Windows systems.

Attackers can modify SSH certificate configurations in GitHub organizations to gain unauthorized access, persist in the environment, escalate privileges, and operate stealthily.

An adversary may delete Kubernetes events to evade detection and hide malicious activity within a Kubernetes environment by removing audit logs.

This rule identifies suspicious SAML activity in AWS, such as AssumeRoleWithSAML and UpdateSAMLProvider events, which could indicate an attacker gaining backdoor access, escalating privileges, or establishing persistence.

Detects when a user successfully resets their own password in Azure Active Directory, which may indicate malicious activity or account compromise.

Detection of a service principal removal in Azure, potentially indicating malicious activity or an attempt to remove evidence of a compromise.

Detection of a failed attempt to invite an external guest user by an Azure user lacking the necessary permissions, potentially indicating privilege escalation or malicious insider activity.

An attacker elevates their Azure subscription permissions to manage all subscriptions, potentially leading to unauthorized access and control over the environment.

Detection of Azure Active Directory accounts that are created and deleted within a short timeframe, potentially indicating malicious activity such as privilege escalation or persistence attempts.

The AWS root account, which grants unrestricted access to all resources within an AWS account, was used, potentially indicating unauthorized activity, privilege escalation, or a breach of security best practices.