Skip to content
Threat Feed
Subscribe

Tag

Tool-Abuse

3 briefs RSS
medium advisory

Detection of Sysinternals Procdump Execution

Detection of the execution of the Sysinternals Procdump utility, which is frequently used by attackers to dump process memory for credential access.

credential-access stealth windows tool-abuse
1r 2t
medium advisory

Abuse of Microsoft Sysinternals PsSuspend Utility

Unidentified threat actors may leverage the legitimate Microsoft Sysinternals PsSuspend utility to suspend critical processes on Windows systems, enabling evasion of security controls or disruption of operations.

Sysinternals PsSuspend sysinternals living-off-the-land process-manipulation windows tool-abuse
1r 4t
medium advisory

Permission Check Via Accesschk.EXE

Attackers are abusing the legitimate Sysinternals `Accesschk.exe` utility to perform permission discovery on Windows systems, a common step in privilege escalation attacks, allowing them to identify misconfigurations for gaining higher privileges.

Accesschk sysinternals privilege-escalation tool-abuse discovery windows
1r 1t