Analytics

ATTACK TechniqueName/IDOperating SystemSource RepositoryLast Modifiedattack_technique_hfilteroperating_system_hfiltersource_repository_hfilter

WMImplant Hack Tool

8028c2c3-e25a-46e3-827f-bbb5abf181d7

November 12, 2021t1047windowssigma

WMI Persistence – Script Event Consumer

ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e

November 12, 2021t1047windowssigma

Suspicious WMI Execution Using Rundll32

3c89a1e8-0fba-449e-8f1b-8409d6267ec8

November 12, 2021t1047windowssigma

Login with WMI

5af54681-df95-4c26-854f-2565e13cfab0

November 12, 2021t1047windowssigma

T1047 Wmiprvse Wbemcomn DLL Hijack

f6c68d5f-e101-4b86-8c84-7d96851fd65c

November 12, 2021t1047windowssigma

UNC2452 PowerShell Pattern

b7155193-8a81-4d8f-805d-88de864ca50c

November 12, 2021t1047windowssigma

Detect SNICat SNI Exfiltration

82d06410-134c-11eb-adc1-0242ac120002

November 12, 2021t1041windowssplunk

DNSCat2 Powershell Implementation Detection Via Process Creation

b11d75d6-d7c1-11ea-87d0-0242ac130003

November 12, 2021t1041windowssigma

Exfiltration and Tunneling Tools Execution

c75309a3-59f8-4a8d-9c2c-4c927ad50555

November 4, 2021t1041windowssigma

Attacker Tools On Endpoint

a51bfe1a-94f0-48cc-b4e4-16a110145893

November 4, 2021t1036-005windowssplunk

Windows Processes Suspicious Parent Directory

96036718-71cc-4027-a538-d1587e0006a7

November 4, 2021t1036-005windowssigma

Common Windows Process Masquerading

CAR-2021-04-001

November 4, 2021t1036-005windowscar

File Created with System Process Name

d5866ddf-ce8f-4aea-b28e-d96485a20d3d

October 25, 2021t1036-005windowssigma

Flash Player Update from Suspicious Location

4922a5dd-6743-4fc2-8e81-144374280997

October 25, 2021t1036-005windowssigma

Exploit for CVE-2015-1641

7993792c-5ce2-4475-a3db-a3a5539827ef

October 25, 2021t1036-005windowssigma

Lazarus Session Highjacker

3f7f5b0b-5b16-476c-a85f-ab477f6dd24b

October 25, 2021t1036-005windowssigma

Suspicious Svchost Process

01d2e2a1-5f09-44f7-9fc1-24faa7479b6d

October 25, 2021t1036-005windowssigma

Suspicious MsiExec Directory

e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144

October 25, 2021t1036-005windowssigma

Findstr Launching .lnk File

33339be3-148b-4e16-af56-ad16ec6c7e7b

October 21, 2021t1027windowssigma

Certutil Encode

e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a

October 21, 2021t1027windowssigma

Application Whitelisting Bypass via Dnx.exe

81ebd28b-9607-4478-bf06-974ed9d53ed7

October 21, 2021t1027windowssigma

Executable in ADS

b69888d4-380c-45ce-9cf9-d9ce46e67821

October 21, 2021t1027windowssigma

Suspicious XOR Encoded PowerShell Command Line

bb780e0c-16cf-4383-8383-1e5471db6cf9

October 21, 2021t1027windowssigma

Visual Basic Command Line Compiler Usage

7b10f171-7f04-47c7-9fa2-5be43c76e535

October 21, 2021t1027windowssigma

Ping Hex IP

1a0d4aba-7668-4365-9ce4-6d79ab088dfd

October 21, 2021t1027windowssigma

Python Py2Exe Image Load

cbb56d62-4060-40f7-9466-d8aaf3123f83

October 21, 2021t1027windowssigma

PowerShell Base64 Encoded Shellcode

2d117e49-e626-4c7c-bd1f-c3c0147774c8

October 21, 2021t1027windowssigma

RedMimicry Winnti Playbook Dropped File

130c9e58-28ac-4f83-8574-0a4cc913b97e

October 21, 2021t1027windowssigma

Failed Code Integrity Checks

470ec5fa-7b4e-4071-b200-4c753100f49b

October 21, 2021t1027windowssigma

CrackMapExec PowerShell Obfuscation

6f8b3439-a203-45dc-a88b-abf57ea15ccf

October 21, 2021t1027windowssigma

Binary Padding

95361ce5-c891-4b0a-87ca-e24607884a96

October 21, 2021t1027macsigma

Binary Padding

c52a914f-3d8b-4b2a-bb75-b3991e75f8ba

October 21, 2021t1027linuxsigma

Operation Wocao Activity

74ad4314-482e-4c3e-b237-3f7ed3b9ca8d

October 21, 2021t1012windowssigma

Decode Base64 Encoded Text

e2072cab-8c9a-459b-b63c-40ae79e27031

October 21, 2021t1027linuxsigma

Decode Base64 Encoded Text

719c22d7-c11a-4f2c-93a6-2cfdd5412f68

October 21, 2021t1027macsigma

Host Discovery Commands

CAR-2016-03-001

, , October 21, 2021t1007linux mac windowscar

Exports Critical Registry Keys To a File

82880171-b475-4201-b811-e9c826cd5eaa

October 21, 2021t1012windowssigma

Exports Registry Key To a File

f0e53e89-8d22-46ea-9db5-9d4796ee2f8a

October 21, 2021t1012windowssigma

SysKey Registry Keys Access

9a4ff3b8-6187-4fd2-8e8b-e0eae1129495

October 21, 2021t1012windowssigma

SAM Registry Hive Handle Request

f8748f2c-89dc-4d95-afb0-5a2dfdbad332

October 21, 2021t1012windowssigma

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , September 10, 2021t1007linux mac windowscar

Query Registry

970007b7-ce32-49d0-a4a4-fbef016950bd

September 10, 2021t1007windowssigma

Defense evasion disable windows firewall rules with netsh

4b438734-3793-4fda-bd42-ceeada0be8f9

July 27, 2021t1562-001windowselastic

Simultaneous Logins on a Host

CAR-2013-02-008

, , July 25, 2021t1078-002linux mac windowscar

Defense evasion cloudwatch alarm deletion

f772ec8a-e182-483c-91d2-72058f76a44c

July 25, 2021t1562-001cloudelastic

Scheduled Task – FileAccess

CAR-2020-09-001

July 19, 2021t1053-005windowscar

Remotely Scheduled Tasks via Schtasks

CAR-2015-04-002

July 19, 2021t1053-005windowscar

Disable UAC

CAR-2021-01-008

July 19, 2021car-2021-01-008windowscar

UAC Bypass

CAR-2019-04-001

July 19, 2021t1548-002windowscar

DLL Injection via Load Library

CAR-2013-10-002

July 19, 2021t1548-002windowscar

Rare LolBAS Command Lines

CAR-2020-05-003

July 19, 2021t1547-001windowscar

Reg.exe called from Command Shell

CAR-2013-03-001

July 19, 2021t1547-001windowscar

Autorun Differences

CAR-2013-01-002

July 19, 2021t1547-001windowscar

Services launching Cmd

CAR-2014-05-002

July 19, 2021t1543-003windowscar

Remotely Launched Executables via Services

CAR-2014-03-005

July 19, 2021t1543-003windowscar

Service Binary Modifications

CAR-2014-02-001

July 19, 2021t1543-003windowscar

Service Outlier Executables

CAR-2013-09-005

July 19, 2021t1543-003windowscar

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , July 19, 2021t1543-003linux mac windowscar

Autorun Differences

CAR-2013-01-002

July 19, 2021t1543-003windowscar

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , July 19, 2021t1518linux mac windowscar

BCDEdit Failure Recovery Modification

CAR-2021-05-003

July 19, 2021t1490windowscar

Detecting Shadow Copy Deletion via Vssadmin.exe

CAR-2021-01-009

July 19, 2021t1490windowscar

Shadow Copy Deletion

CAR-2020-04-001

July 19, 2021t1490windowscar

Access Permission Modification

CAR-2019-07-001

, , July 19, 2021t1222-001linux mac windowscar

RunDLL32.exe monitoring

CAR-2014-03-006

July 19, 2021t1218-011windowscar

Squiblydoo

CAR-2019-04-003

July 19, 2021t1218-010windowscar

Generic Regsvr32

CAR-2019-04-002

July 19, 2021t1218-010windowscar

Compiled HTML Access

CAR-2020-11-009

July 19, 2021t1218-001windowscar

Batch File Write to System32

CAR-2021-05-002

July 19, 2021t1204-002windowscar

CertUtil With Decode Argument

CAR-2021-05-009

July 19, 2021t1140windowscar

Addition of SID History to Active Directory Object

2632954e-db1c-49cb-9936-67d1ef1d17d2

July 19, 2021t1134windowssigma

Detection of Possible Rotten Potato

6c5808ee-85a2-4e56-8137-72e5876a5096

July 19, 2021t1134windowssigma

Meterpreter or Cobalt Strike Get System Service Start

15619216-e993-4721-b590-4c520615a67d

July 19, 2021t1134windowssigma

Meterpreter or Cobalt Strike Get System Service Installation

843544a7-56e0-4dcc-a44f-5cc266dd97d6

July 19, 2021t1134windowssigma

Failed Logon From Public IP

f88e112a-21aa-44bd-9b01-6ee2a2bbbed1

July 13, 2021t1133windowssigma

Illegal Access To User Content via PowerSploit modules

01fc7d91-eb0c-478e-8633-e4fa4904463a

July 13, 2021t1112windowssplunk

Suspicious System.Drawing Load

666ecfc7-229d-42b8-821e-1a8f8cb7057c

July 13, 2021t1112windowssigma

Screen Capture – macOS

0877ed01-da46-4c49-8476-d49cdd80dfa7

July 13, 2021t1112linuxsigma

FodHelper UAC Bypass

909f8fd8-7ac8-11eb-a1f3-acde48001122

July 13, 2021t1112windowssplunk

Revil Registry Entry

e3d3f57a-c381-11eb-9e35-acde48001122

July 13, 2021t1112windowssplunk

Suspicious Reg exe Process

a6b3ab4e-dd77-4213-95fa-fc94701995e0

July 13, 2021t1112windowssplunk

Uncommon Registry Persistence Change

54902e45-3467-49a4-8abc-529f2c8cfb80

July 13, 2021t1112windowselastic

OceanLotus Registry Activity

4ac5fc44-a601-4c06-955b-309df8c4e9d4

July 13, 2021t1112windowssigma

Suspicious VBoxDrvInst.exe Parameters

b7b19cb6-9b32-4fc4-a108-73f19acfe262

July 13, 2021t1112windowssigma

Non-privileged Usage of Reg or Powershell

8f02c935-effe-45b3-8fc9-ef8696a9e41d

July 13, 2021t1112windowssigma

DNS ServerLevelPluginDll Install

e61e8a88-59a9-451c-874e-70fcc9740d67

July 13, 2021t1112windowssigma

NetNTLM Downgrade Attack

d67572a0-e2ec-45d6-b8db-c100d14b8ef2

July 13, 2021t1112windowssigma

Disable Security Events Logging Adding Reg Key MiniNt

919f2ef0-be2d-4a7a-b635-eb2b41fde044

July 13, 2021t1112windowssigma

Sysmon Channel Reference Deletion

18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc

July 13, 2021t1112windowssigma

Removal of Potential COM Hijacking Registry Keys

96f697b0-b499-4e5d-9908-a67bec11cdb6

July 13, 2021t1112windowssigma

DHCP Callout DLL Installation

9d3436ef-9476-4c43-acca-90ce06bdf33a

July 13, 2021t1112windowssigma

Modifies the Registry From a File

5f60740a-f57b-4e76-82a1-15b6ff2cb134

July 13, 2021t1112windowssigma

Imports Registry Key From a File

73bba97f-a82d-42ce-b315-9182e76c57b1

July 13, 2021t1112windowssigma

Blue Mockingbird

c3198a27-23a0-4c2c-af19-e5328d49680e

July 13, 2021t1112windowssigma

Modifies the Registry From a ADS

77946e79-97f1-45a2-84b4-f37b5c0d8682

July 13, 2021t1112windowssigma

RDP Registry Modification

41904ebe-d56c-4904-b9ad-7a77bdf154b3

July 13, 2021t1112windowssigma

Persistent Outlook Landing Pages

ddd171b5-2cc6-4975-9e78-f0eccd08cc76

July 13, 2021t1112windowssigma

Imports Registry Key From an ADS

0b80ade5-6997-4b1d-99a1-71701778ea61

July 13, 2021t1112windowssigma

Remote Registry Management Using Reg Utility

68fcba0d-73a5-475e-a915-e8b4c576827e

July 13, 2021t1112windowssigma

ShimCache Flush

b0524451-19af-4efa-a46f-562a977f792e

July 13, 2021t1112windowssigma

Wdigest CredGuard Registry Modification

1a2d6c47-75b0-45bd-b133-2c0be75349fd

July 13, 2021t1112windowssigma

Run Once Task Execution as Configured in Registry

198effb6-6c98-4d0c-9ea3-451fa143c45c

July 13, 2021t1112windowssigma

FlowCloud Malware

5118765f-6657-4ddb-a487-d7bd673abbf1

July 13, 2021t1112windowssigma

Run Once Task Configuration in Registry

c74d7efc-8826-45d9-b8bb-f04fac9e4eff

July 13, 2021t1112windowssigma

Suspicious New Printer Ports in Registry (CVE-2020-1048)

7ec912f2-5175-4868-b811-ec13ad0f8567

July 13, 2021t1112windowssigma

Wdigest Enable Use Logon

d6a9b252-c666-4de6-8806-5561bbbd3bdc

July 13, 2021t1112windowssigma

Persistent Outlook Landing Pages

487bb375-12ef-41f6-baae-c6a1572b4dd1

July 13, 2021t1112windowssigma

RDP Sensitive Settings Changed

171b67e1-74b4-460e-8d55-b331f3e32d67

July 13, 2021t1112windowssigma

Registry Entries For Azorult Malware

f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7

July 13, 2021t1112windowssigma

Ursnif

21f17060-b282-4249-ade0-589ea3591558

July 13, 2021t1112windowssigma

Office Security Settings Changed

a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd

 

July 13, 2021t1112windowssigma

RedMimicry Winnti Playbook Registry Manipulation

5b175490-b652-4b02-b1de-5b5b4083c5f8

July 13, 2021t1112windowssigma

Remote Registry

CAR-2014-11-005

July 13, 2021t1112windowscar

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , July 13, 2021t1112linux mac windowscar

Autorun Differences

CAR-2013-01-002

July 13, 2021t1112windowscar

High Number of Login Failures from a single source

7f398cfb-918d-41f4-8db8-2e2474e02222

July 13, 2021t1110-001experimentalsplunk

Secure Deletion with SDelete

39a80702-d7ca-4a83-b776-525b1f86a36d

July 13, 2021t1107windowssigma

Cisco File Deletion

71d65515-c436-43c0-841b-236b1f32c21e

July 13, 2021t1107networksigma

Backup Catalog Deleted

9703792d-fd9a-456d-a672-ff92efe4806a

July 13, 2021t1107windowssigma

Illegal Service and Process Control via PowerSploit modules

0e910e5b-309d-4bc3-8af2-0030c02aa353

July 13, 2021t1106windowssplunk

Illegal Service and Process Control via Mimikatz modules

aaf3adf1-73e1-4477-b4ee-3771898964f1

July 13, 2021t1106windowssplunk

Suspicious SolarWinds Child Process

93b22c0a-06a0-4131-b830-b10d5e166ff4

July 13, 2021t1106windowselastic

Accessing WinAPI in PowerShell

03d83090-8cba-44a0-b02f-0b756a050306

July 13, 2021t1106windowssigma

Possible App Whitelisting Bypass via WinDbg/CDB as a Shellcode Runner

b5c7395f-e501-4a08-94d4-57fe7a9da9d2

July 13, 2021t1106windowssigma

RedMimicry Winnti Playbook Execute

95022b85-ff2a-49fa-939a-d7b8f56eeb9b

July 13, 2021t1106windowssigma

Download Files Using Telegram

58194e28-ae5e-11eb-8912-acde48001122

July 13, 2021t1105windowssplunk

Suspicious Curl Network Connection

3f613dc0-21f2-4063-93b1-5d3c15eef22f

July 13, 2021t1105experimentalsplunk

Office Product Spawning CertUtil

6925fe72-a6d5-11eb-9e17-acde48001122

July 13, 2021t1105windowssplunk

BITSAdmin Download File

80630ff4-8e4c-11eb-aab5-acde48001122

July 13, 2021t1105windowssplunk

CertUtil Download With VerifyCtl and Split Arguments

801ad9e4-8bfb-11eb-8b31-acde48001122

July 13, 2021t1105windowssplunk

CertUtil Download With URLCache and Split Arguments

415b4306-8bfb-11eb-85c4-acde48001122

July 12, 2021t1105windowssplunk

Command And Control Download RAR Powershell from Internet

ff013cb4-274d-434a-96bb-fe15ddd3ae92

July 12, 2021t1105networkelastic

Apple Script Execution followed by Network Connection

47f76567-d58a-4fed-b32b-21f571e28910

July 12, 2021t1105macelastic

Execution command prompt connecting to the internet

89f9a4b0-9f8f-4ee0-8823-c4751a6d6696

July 12, 2021t1105windowselastic

Remote File Download via PowerShell

33f306e8-417c-411b-965c-c2812d6d3f4d

July 12, 2021t1105windowselastic

Remote File Download via MpCmdRun

c6453e73-90eb-4fe7-a98c-cde7bbfc504a

 

July 12, 2021t1105windowselastic

Detect Excessive User Account Lockouts

95a7f9a5-6096-437e-a19e-86f42ac609bd

July 12, 2021t1078-003macelastic

External Disk Drive or USB Storage Device

f69a87ea-955e-4fb4-adb2-bb9fd6685632

July 12, 2021t1091windowssigma

Suspicious C2 Activities

f7158a64-6204-4d6d-868a-6e6378b467e0

July 12, 2021t1095linuxsigma

Detect Large Outbound ICMP Packets

e9c102de-4d43-42a7-b1c8-8062ea297419

July 12, 2021t1095experimentalsplunk

Suspicious Arguments

CAR-2013-07-001

, , July 12, 2021t1105linux mac windowscar

BITSAdmin Download File

CAR-2021-05-005

July 12, 2021t1105windowscar

CertUtil Download With URLCache and Split Arguments

CAR-2021-05-006

July 12, 2021t1105windowscar

CertUtil Download With VerifyCtl and Split Arguments

CAR-2021-05-007

July 12, 2021t1105windowscar

Remote File Copy

7a14080d-a048-4de8-ae58-604ce58a795b

July 12, 2021t1105linuxsigma

Windows Update Client LOLBIN

d7825193-b70a-48a4-b992-8b5b3015cc11

July 12, 2021t1105windowssigma

Microsoft Binary Suspicious Communication Endpoint

e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97

July 12, 2021t1105windowssigma

MsiExec Web Install

f7b5f842-a6af-4da5-9e95-e32478f3cd2f

July 12, 2021t1105windowssigma

Cisco Stage Data

5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59

July 12, 2021t1105networksigma

Pandemic Registry Key

47e0852a-cf81-4494-a8e6-31864f8c86ed

July 12, 2021t1105windowssigma

Curl Start Combination

21dd6d38-2b18-4453-9404-a0fe4a0cc288

July 12, 2021t1105windowssigma

Finger.exe Suspicious Invocation

af491bca-e752-4b44-9c86-df5680533dbc

July 12, 2021t1105windowssigma

Malicious Payload Download via Office Binaries

0c79148b-118e-472b-bdb7-9b57b444cc19

July 12, 2021t1105windowssigma

Windows Defender Download Activity

46123129-1024-423e-9fae-43af4a0fa9a5

July 12, 2021t1105windowssigma

Suspicious Curl Usage on Windows

e218595b-bbe7-4ee5-8a96-f32a24ad3468

July 12, 2021t1105windowssigma

PowerShell Download File

8f70ac5f-1f6f-4f8e-b454-db19561216c5

July 12, 2021t1105windowssigma

Executable from Webdav

aac2fd97-bcba-491b-ad66-a6edf89c71bf

July 12, 2021t1105networksigma

GfxDownloadWrapper.exe Downloads File from Suspicious URL

eee00933-a761-4cd0-be70-c42fe91731e7

July 12, 2021t1105windowssigma

Microsoft Binary Github Communication

635dbb88-67b3-4b41-9ea5-a3af2dd88153

July 12, 2021t1105windowssigma

Suspicious Desktop Image Downloader Target File

fc4f4817-0c53-4683-a4ee-b17a64bc1039

July 12, 2021t1105windowssigma

Command Line Execution with Suspicious URL and AppData Strings

1ac8666b-046f-4201-8aba-1951aaec03a3

July 12, 2021t1105windowssigma

Copy from Admin Share

855bc8b5-2ae8-402e-a9ed-b889e6df1900

July 12, 2021t1105windowssigma

Suspicious Certutil Command

e011a729-98a6-4139-b5c4-bf6f6dd8239a

July 12, 2021t1105windowssigma

Greenbug Campaign Indicators

3711eee4-a808-4849-8a14-faf733da3612

July 12, 2021t1105windowssigma

Download from Suspicious Dyndns Hosts

195c1119-ef07-4909-bb12-e66f5e07bf3c

July 12, 2021t1105proxysigma

Remote File Copy via TeamViewer

b25a7df2-120a-4db2-bd3f-3e4b86b24bee

July 12, 2021t1105windowselastic

Remote File Download via Script Interpreter

1d276579-3380-4095-ad38-e596a01bc64f

July 12, 2021t1105windowselastic

Remote File Download via Desktop Image Downloader Utility

15c0b7a7-9c34-4869-b25b-fa6518414899

July 12, 2021t1105windowselastic

Network Connection via Certutil

3838e0e3-1850-4850-a411-2e8c5ba40ba8

July 12, 2021t1105windowselastic

Suspicious Desktop Image Downloader Command

bb58aa4a-b80b-415a-a2c0-2f65a4c81009

 

July 12, 2021t1105windowssigma

Privilege escalation local user added to admin

565c2b44-7a21-4818-955f-8d4737967d2e

July 11, 2021t1078-003macelastic

Persistence account creation hide at logon

41b638a1-8ab6-4f8e-86d9-466317ef2db5

July 11, 2021t1078-003macelastic

Persistence enable root account

cc2fd2d0-ba3a-4939-b87f-2901764ed036

July 11, 2021t1078-003macelastic

Admin User Remote Logon

0f63e1ef-1eb9-4226-9d54-8927ca08520a

July 11, 2021t1078-003windowssigma

User Login Activity Monitoring

CAR-2013-10-001

, , July 11, 2021t1078-003linux mac windowscar

SMB Copy and Execution

CAR-2013-05-005

, , July 11, 2021t1078-003linux mac windowscar

SMB Write Request

CAR-2013-05-003

, , July 11, 2021t1078-003linux mac windowscar

User Logged in to Multiple Hosts

CAR-2013-02-012

, , July 11, 2021t1078-003linux mac windowscar

Suspicious Scheduled Task from Public Directory

7feb7972-7ac3-11eb-bac8-acde48001122

July 11, 2021t1053-005windowssplunk

Invoke-Obfuscation STDIN+ Launcher

6c96fc76-0eb1-11eb-adc1-0242ac120002

July 11, 2021t1059-001windowssigma

Execution with schtasks

CAR-2013-08-001

July 11, 2021t1053-005windowscar

Invoke-Obfuscation Via Use Clip

e1561947-b4e3-4a74-9bdd-83baed21bdb5

July 11, 2021t1059-001windowssigma

Impact cloud watch log stream deletion

d624f0ae-3dd1-4856-9aad-ccfe4d4bfa17

July 11, 2021t1562-001cloudelastic

Defense evasion waf acl deletion

91d04cd4-47a9-4334-ab14-084abe274d49

July 11, 2021t1562-001cloudelastic

Defense evasion event hub deletion

e0f36de1-0342-453d-95a9-a068b257b053

July 11, 2021t1562-001cloudelastic

Impact cloud watch log group deletion

68a7a5a5-a2fc-4a76-ba9f-26849de881b4

July 11, 2021t1562-001cloudelastic

Defense evasion SolarWinds backdoor service disabled via registry

b9960fef-82c6-4816-befa-44745030e917

July 11, 2021t1562-001windowselastic

Defense evasion network watcher deletion

323cb487-279d-4218-bcbd-a568efe930c6

July 11, 2021t1562-001cloudelastic

Defense evasion guard duty detector deletion

523116c0-d89d-4d7c-82c2-39e6845a78ef

July 11, 2021t1562-001cloudelastic

Defense evasion cloudtrail logging suspended

1aa8fa52-44a7-4dae-b058-f3333b91c8d7

July 11, 2021t1562-001cloudelastic

Defense evasion firewall policy deletion

e02bd3ea-72c6-4181-ac2b-0f83d17ad969

July 11, 2021t1562-001cloudelastic

Defense evasion ec2 flow log deletion

9395fd2c-9947-4472-86ef-4aceb2f7e872

July 11, 2021t1562-001cloudelastic

Defense evasion apple software updates modification

f683dcdf-a018-4801-b066-193d4ae6c8e5

July 11, 2021t1562-001macelastic

Defense evasion attempt to disable syslog service

2f8a1226-5720-437d-9c20-e0029deb6194

July 11, 2021t1562-001linuxelastic

Defense evasion scheduled jobs at protocol enabled

9aa0e1f6-52ce-42e1-abb3-09657cee2698

July 11, 2021t1562-001windowselastic

Defense evasion waf rule or rule group deletion

5beaebc1-cc13-4bfc-9949-776f9e0dc318

July 8, 2021t1562-001cloudelastic

Defense evasion cloudtrail logging deleted

7024e2a0-315d-4334-bb1a-441c593e16ab

July 8, 2021t1562-001cloudelastic

Defense evasion azure diagnostic settings deletion

5370d4cd-2bb3-4d71-abf5-1e1d0ff5a2de

July 8, 2021t1562-001cloudelastic

Defense evasion attempt del quarantine attrib

f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7

July 8, 2021t1562-001macelastic

Defense evasion configuration recorder stopped

fbd44836-0d69-4004-a0b4-03c20370c435

July 8, 2021t1562-001cloudelastic

Defense evasion defender disabled via registry

2ffa1f1e-b6db-47fa-994b-1512743847eb

July 8, 2021t1562-001windowselastic

Defense evasion safari config change

6482255d-f468-45ea-a5b3-d3a7de1331ae

July 8, 2021t1562-001macelastic

Defense evasion privacy controls tcc database modification

eea82229-b002-470e-a9e1-00be38b14d32

July 8, 2021t1562-001macelastic

Defense evasion amenable key mod

f874315d-5188-4b4a-8521-d1c73093a7e4

July 8, 2021t1562-001windowselastic

Defense evasion port forwarding added registry

3535c8bb-3bd5-40f4-ae32-b7cd589d5372

July 7, 2021t1562-001windowselastic

Defense evasion disable selinux attempt

eb9eb8ba-a983-41d9-9c93-a1c05112ca5e

 

July 7, 2021t1562-001linuxelastic

Defense evasion unload endpointsecurity text

70fa1af4-27fd-4f26-bd03-50b6af6b9e24

July 7, 2021t1562-001macelastic

Detecting Tampering of Windows Defender Command Prompt

CAR-2021-01-007

July 7, 2021t1562-001windowscar

User Activity from Stopping Windows Defensive Services

CAR-2016-04-003

July 7, 2021t1562-001windowscar

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , July 7, 2021t1562-001linux mac windowscar

Defense evasion cve

56557cde-d923-4b88-adee-c61b3f3b5dc3

July 7, 2021t1553-002windowselastic

Schtasks used for forcing a reboot

1297fb80-f42a-4b4a-9c8a-88c066437cf6

July 7, 2021t1053-005windowssplunk

Scheduled Task Deleted Or Created via CMD

d5af132c-7c17-439c-9d31-13d55340f36c

July 7, 2021t1053-005windowssplunk

Schtasks scheduling job on remote system

1297fb80-f42a-4b4a-9c8a-88c066237cf6

July 7, 2021t1053-005windowssplunk

WinEvent Scheduled Task Created to Spawn Shell

203ef0ea-9bd8-11eb-8201-acde48001122

July 7, 2021t1053-005windowssplunk

WinEvent Scheduled Task Created Within Public Path

5d9c6eee-988c-11eb-8253-acde48001122

July 7, 2021t1053-005windowssplunk

Schedule Task with HTTP Command Arguments

523c2684-a101-11eb-916b-acde48001122

July 7, 2021t1053-005windowssplunk

Powershell Execution

CAR-2014-04-003

July 7, 2021t1059-001windowscar

Remote PowerShell Sessions

CAR-2014-11-004

July 7, 2021t1059-001windowscar

T1086 PowerShell Execution

ac7102b4-9e1e-4802-9b4f-17c5524c015c

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

e9f55347-2928-4c06-88e5-1a7f8169942e

July 7, 2021t1059-001windowssigma

Encoded FromBase64String

fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c

July 7, 2021t1059-001windowssigma

FromBase64String Command Line

e32d4572-9826-4738-b651-95fa63747e8a

July 7, 2021t1059-001windowssigma

PowerShell Encoded Character Syntax

e312efd0-35a1-407f-8439-b8d434b438a6

July 7, 2021t1059-001windowssigma

Encoded IEX

88f680b8-070e-402c-ae11-d2914f2257f1

July 7, 2021t1059-001windowssigma

Dnscat Execution

a6d67db4-6220-436d-8afc-f3842fe05d43

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation Via Stdin

9c14c9fa-1a63-4a64-8e57-d19280559490

 

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation VAR+ Launcher

27aec9c9-dbb0-4939-8422-1742242471d0

July 7, 2021t1059-001windowssigma

Suspicious PowerShell Invocations – Generic

3d304fda-78aa-43ed-975c-d740798a49c1

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation CLIP+ Launcher

b222df08-0e07-11eb-adc1-0242ac120002

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation Via Use MSHTA

ac20ae82-8758-4f38-958e-b44a3140ca88

July 7, 2021t1059-001windowssigma

Defense evasion attempt to disable iptables or firewall

125417b8-d3df-479f-8418-12d7e034fee3

July 7, 2021t1562-001linuxelastic

Defense evasion enable inbound rdp with netsh

074464f9-f30d-4029-8c03-0ed237fffec7

July 7, 2021t1562-001windowselastic

Invoke-Obfuscation RUNDLL LAUNCHER

056a7ee1-4853-4e67-86a0-3fd9ceed7555

July 7, 2021t1059-001windowssigma

Defense evasion stop process service threshold

035889c4-2686-4583-a7df-67f89c292f2c

July 7, 2021t1562-001windowselastic

Invoke-Obfuscation Via Use Rundll32

36c5146c-d127-4f85-8e21-01bf62355d5a

July 7, 2021t1059-001windowssigma

Credentials in Files & Registry

CAR-2020-09-004

July 7, 2021t1552-001windowscar

Credential access collection sensitive files

6b84d470-9036-4cc0-a27c-6d90bbfe81ab

July 7, 2021t1552-001linuxelastic

Credential access key vault modified

792dd7a6-7e00-4a0a-8a9a-a7c24720b5ec

July 7, 2021t1552-001cloudelastic

Suspicious XOR Encoded PowerShell Command Line

812837bb-b17f-45e9-8bd0-0ec35d2e3bd6

July 7, 2021t1059-001windowssigma

Too Long PowerShell Commandlines

d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6

July 7, 2021t1059-001windowssigma

Suspicious CLR Logs Creation

e4b63079-6198-405c-abd7-3fe8b0ce3263

July 7, 2021t1059-001windowssigma

PowerShell Called from an Executable Version Mismatch

c70e019b-1479-4b65-b0cc-cd0c6093a599

July 7, 2021t1059-001windowssigma

Suspicious PowerShell Download

65531a81-a694-4e31-ae04-f8ba5bc33759

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation COMPRESS OBFUSCATION

7eedcc9d-9fdb-4d94-9c54-474e8affc0c7

July 7, 2021t1059-001windowssigma

PowerShell Execution

867613fb-fa60-4497-a017-a82df74a172c

July 7, 2021t1059-001windowssigma

Accessing WinAPI in PowerShell. Code Injection.

eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation Via Stdin

86b896ba-ffa1-4fea-83e3-ee28a4c915c7

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation Via Use Clip

db92dd33-a3ad-49cf-8c2c-608c3e30ace0

July 7, 2021t1059-001windowssigma

PowerShell Download from URL

3b6ab547-8ec2-4991-b9d2-2b06702a48d7

July 7, 2021t1059-001windowssigma

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

e54f5149-6ba3-49cf-b153-070d24679126

July 7, 2021t1059-001windowssigma

Alternate PowerShell Hosts

fe6e002f-f244-4278-9263-20e4b593827f

July 7, 2021t1059-001windowssigma

PowerShell Create Local User

243de76f-4725-4f2e-8225-a8a69b15ad61

July 7, 2021t1059-001windowssigma

Any Powershell DownloadFile

1a93b7ea-7af7-11eb-adb5-acde48001122

July 7, 2021t1059-001windowssplunk

Any Powershell DownloadString

4d015ef2-7adf-11eb-95da-acde48001122

July 7, 2021t1059-001windowssplunk

Detect SharpHound Command-Line Arguments

a0bdd2f6-c2ff-11eb-b918-acde48001122

July 7, 2021t1059-001windowssplunk

Detect SharpHound Usage

dd04b29a-beed-11eb-87bc-acde48001122

July 7, 2021t1059-001windowssplunk

Detect SharpHound File Modifications

42b4b438-beed-11eb-ba1d-acde48001122

July 7, 2021t1059-001windowssplunk

Malicious PowerShell Process With Obfuscation Techniques

cde75cf6-3c7a-4dd6-af01-27cdb4511fd4

July 7, 2021t1059-001windowssplunk

Set Default PowerShell Execution Policy To Unrestricted or Bypass

c2590137-0b08-4985-9ec5-6ae23d92f63d

July 7, 2021t1059-001windowssplunk

Malicious PowerShell Process – Execution Policy Bypass

9be56c82-b1cc-4318-87eb-d138afaaca39

July 7, 2021t1059-001windowssplunk

Malicious PowerShell Process – Connect To Internet With Hidden Window

ee18ed37-0802-4268-9435-b3b91aaa18db

July 7, 2021t1059-001windowssplunk

Nishang PowershellTCPOneLine

1a382c6c-7c2e-11eb-ac69-acde48001122

July 7, 2021t1059-001windowssplunk

Powershell Processing Stream Of Data

0d718b52-c9f1-11eb-bc61-acde48001122

July 7, 2021t1059-001windowssplunk

Detect AzureHound Command-Line Arguments

26f02e96-c300-11eb-b611-acde48001122

July 7, 2021t1059-001windowssplunk

Detect AzureHound File Modifications

1c34549e-c31b-11eb-996b-acde48001122

July 7, 2021t1059-001windowssplunk

Detect Mimikatz Using Loaded Images

29e307ba-40af-4ab2-91b2-3c6b392bbba0

July 7, 2021t1059-001windowssplunk

Processes Spawning cmd.exe

CAR-2013-02-003

July 7, 2021t1059-003windowscar

Outlier Parents of Cmd

CAR-2014-11-002

July 7, 2021t1059-003windowscar

Cmd.exe CommandLine Path Traversal

087790e3-3287-436c-bccf-cbd0184a7db1

July 7, 2021t1059-003windowssigma

ZxShell Malware

f0b70adb-0075-43b0-9745-e82a1c608fcc

July 7, 2021t1059-003windowssigma

Elise Backdoor

e507feb7-5f73-4ef6-a970-91bb6f6d744f

July 7, 2021t1059-003windowssigma

Sofacy Trojan Loader Activity

ba778144-5e3d-40cf-8af9-e28fb1df1e20

July 7, 2021t1059-003windowssigma

Baby Shark Activity

2b30fa36-3a18-402f-a22d-bf4ce2189f35

July 7, 2021t1059-003windowssigma

Koadic Execution

5cddf373-ef00-4112-ad72-960ac29bac34

July 7, 2021t1059-003windowssigma

Command Line Execution with Suspicious URL and AppData Strings

1ac8666b-046f-4201-8aba-1951aaec03a3

July 7, 2021t1059-003windowssigma

AWS EC2 Startup Shell Script Change

1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df

July 7, 2021t1059-003cloudsigma

HTML Help Shell Spawn

52cad028-0ff0-4854-8f67-d25dfcbc78b4

July 7, 2021t1059-003windowssigma

Suspicious HWP Sub Processes

023394c4-29d5-46ab-92b8-6a534c6f447b

July 7, 2021t1059-003windowssigma

Exploiting SetupComplete.cmd CVE-2019-1378

1c373b6d-76ce-4553-997d-8c1da9a6b5f5

July 7, 2021t1059-003windowssigma

Exploited CVE-2020-10189 Zoho ManageEngine

846b866e-2a57-46ee-8e16-85fa92759be7

July 7, 2021t1059-003windowssigma

Detect Excessive User Account Lockouts

95a7f9a5-6096-437e-a19e-86f42ac609bd

July 7, 2021t1078-002windowssplunk

CrackMapExec Command Execution

058f4380-962d-40a5-afce-50207d36d7e2

July 7, 2021t1059-003windowssigma

Detect Prohibited Applications Spawning cmd exe

dcfd6b40-42f9-469d-a433-2e53f7486664

July 7, 2021t1059-003windowssplunk

Detect Use of cmd exe to Launch Script Interpreters

b89919ed-fe5f-492c-b139-95dbb162039e

July 7, 2021t1059-003windowssplunk

Ryuk Wake on LAN Command

538d0152-7aaa-11eb-beaa-acde48001122

July 7, 2021t1059-003windowssplunk

CMD Echo Pipe – Escalation

eb277ba0-b96b-11eb-b00e-acde48001122

July 7, 2021t1059-003windowssplunk

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , July 7, 2021t1059-005linux mac windowscar

WSF/JSE/JS/VBA/VBE File Execution

1e33157c-53b1-41ad-bbcc-780b80b58288

July 7, 2021t1059-005windowssigma

WMIExec VBS Script

966e4016-627f-44f7-8341-f394905c361f

July 7, 2021t1059-005windowssigma

Application Whitelisting Bypass via Bginfo

aaf46cdc-934e-4284-b329-34aa701e3771

July 7, 2021t1059-005windowssigma

Suspicious Parent of Csc.exe

b730a276-6b63-41b8-bcf8-55930c8fc6ee

July 7, 2021t1059-005windowssigma

SquiblyTwo

8d63dadf-b91b-4187-87b6-34a1114577ea

July 7, 2021t1059-005windowssigma

Powershell Reverse Shell Connection

edc2f8ae-2412-4dfd-b9d5-0c57727e70be

July 7, 2021t1059-005windowssigma

CACTUSTORCH Remote Thread Creation

2e4e488a-6164-4811-9ea1-f960c7359c40

July 7, 2021t1059-005windowssigma

Autorun Differences

CAR-2013-01-002

July 7, 2021t1053-005windowscar

Quick execution of a series of suspicious commands

CAR-2013-04-002

, , July 7, 2021t1053-005linux mac windowscar

QBot Process Creation

4fcac6eb-0287-4090-8eea-2602e4c20040

July 7, 2021t1059-005windowssigma

WScript or CScript Dropper

cea72823-df4d-4567-950c-0b579eaf0846

July 7, 2021t1059-005windowssigma

Exchange PowerShell Snap-Ins Used by HAFNIUM

25676e10-2121-446e-80a4-71ff8506af47

July 7, 2021t1059-005websigma

Suspicious Scripting in a WMI Consumer

fe21810c-2a8c-478f-8dd3-5a287fb2a0e0

July 7, 2021t1059-005windowssigma

Koadic Execution

5cddf373-ef00-4112-ad72-960ac29bac34

July 7, 2021t1059-005windowssigma

HTML Help Shell Spawn

52cad028-0ff0-4854-8f67-d25dfcbc78b4

July 7, 2021t1059-005windowssigma

Windows Shell Spawning Suspicious Program

3a6586ad-127a-4d3b-a677-1e6eacdf8fde

July 7, 2021t1059-005windowssigma

Adwind RAT / JRAT

1fac1481-2dbc-48b2-9096-753c49b4ec71

July 7, 2021t1059-005windowssigma

Suspicious File Characteristics Due to Missing Fields

9637e8a5-7131-4f7f-bdc7-2b05d8670c43

July 7, 2021t1059-005windowssigma

User Login Activity Monitoring

CAR-2013-10-001

, , July 6, 2021t1078-002linux mac windowscar

Detect Excessive Account Lockouts From Endpoint

c026e3dd-7e18-4abb-8f41-929e836efe74

July 6, 2021t1078-002windowssplunk

File Was Not Allowed To Run

401e5d00-b944-11ea-8f9a-00163ecd60ae

July 6, 2021t1059-005windowssigma

SMB Write Request

CAR-2013-05-003

, , July 6, 2021t1078-002linux mac windowscar

Pin It on Pinterest

Share This