Remote Services detection rulesT1021

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

windows · file_event

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

windows · image_load

Detects automated lateral movement by Turla group

windows · process_creation

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

windows · file_event

Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.

windows · image_load

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

windows

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

windows

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

zeek

Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

windows · process_creation

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution.

windows · file_event

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

windows · process_creation

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

windows · process_creation

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

windows · process_creation

Detects execution of Impacket's psexec.py.

windows

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

windows

Alerts on Metasploit host's authentications on the domain.

windows

Detects a Windows command line executable started from MMC

windows · process_creation

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

windows · process_creation

Detects an RDP connection originating from a domain controller.

windows · network_connection

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

zeek

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where an SMB service on an OpenCanary node has had a file open request.

opencanary · application

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

windows · network_connection

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

windows · registry_set

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

windows · process_creation

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

windows · network_connection

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

windows · process_creation

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

windows · process_creation

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

windows

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

zeek

RDP login with localhost source address may be a tunnelled login

windows

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

windows · network_connection

Detects svchost hosting RDP termsvcs communicating with the loopback address

windows

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

windows · network_connection

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

rpc_firewall · application

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

windows · process_access

Detects remote PowerShell sessions

windows · ps_module

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

windows · process_creation

Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh.

windows · process_creation

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

windows

Detects the use of smbexec.py tool by detecting a specific service installation

windows

Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.

windows · process_creation

Detects suspicious Plink tunnel port forwarding to a local port

windows · process_creation

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

windows

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

zeek

Detects a suspicious RDP session redirect using tscon.exe

windows · process_creation

Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.

windows · process_creation

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

windows · process_creation

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.

windows

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

windows · process_creation

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

windows · process_creation

Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.

windows · process_creation

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

windows · image_load

Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

aws

Detects Bitbucket global SSH access configuration changes.

bitbucket

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

bitbucket

Detects a copy command or a copy utility execution to or from an Admin share or remote

windows · process_creation

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

windows

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

windows

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

windows · ps_script

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

windows · ps_script

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

windows · process_creation

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

windows · process_creation

Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool. Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.

windows · process_creation

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

windows

Detects a when net.exe is called with a password in the command line

windows · process_creation

Detects port forwarding activity via SSH.exe

windows · process_creation

Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.

windows · process_creation

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

windows · process_creation

Detects user accept agreement execution in psexec commandline

windows · process_creation

Detects default CSExec pipe creation

windows · pipe_created

Detects default RemCom pipe creation

windows · pipe_created

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

windows · process_creation

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

windows · process_creation

Detects remote service activity via remote access to the svcctl named pipe

windows

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

zeek

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

windows · ps_script

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

windows

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

windows · image_load

Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares.

windows

Detects when an admin share is mounted using net.exe

windows · process_creation

Detects access to ADMIN$ network share

windows

Detects execution of "Net.EXE".

windows · process_creation

Detects remote PowerShell sessions

windows · ps_classic_start

Detects when a share is mounted using the "net.exe" utility

windows · process_creation