Event Triggered Execution detection rulesT1546

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

windows · process_creation

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

windows · process_creation

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows · process_creation

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows · registry_event

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

windows · process_creation

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

windows · process_creation

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

windows · registry_set

Detects potential COM object hijacking via modification of default system CLSID.

windows · registry_set

Detects the malicious use of a control panel item

windows · process_creation

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

windows

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

windows · registry_set

Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.

windows · process_creation

Detects the modification of Outlook security setting to allow unprompted execution of macros.

windows · registry_set

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

windows · registry_set

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

windows · registry_set

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

windows · registry_set

Detects the installation of a new shim database where the file is located in a non-default location

windows · registry_set

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

windows · process_creation

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

windows · registry_set

load malicious registered COM objects

windows · process_creation

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

windows · registry_event

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

windows · process_creation

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

windows · process_creation

Detects suspicious encoded payloads in WMI Event Consumers

windows · wmi_event

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

windows · file_event

Detects the creation of a macro file for Outlook.

windows · file_event

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

windows · registry_set

Detects WMI command line event consumers

windows · image_load

Detects file writes of WMI script event consumer

windows · file_event

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

windows · registry_set

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

macos · file_event

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

windows · registry_event

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

windows · registry_event

Detects the creation of a macro file for Outlook.

windows · file_event

Detects value modification of registry key containing path to binary used as screensaver.

windows · registry_event

Detects COM object hijacking via TreatAs subkey

windows · registry_set

Detects potential persistence using Appx DebugPath

windows · registry_set

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

windows · registry_set

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

windows · process_creation

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

windows · registry_set

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

windows · ps_script

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

windows · registry_set

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

windows · registry_set

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.

windows

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

windows · process_creation

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

windows · process_creation

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

windows · file_event

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

windows · ps_script

Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.

windows · process_creation

Detects modification of autostart extensibility point (ASEP) in registry.

windows · registry_set

Detects suspicious Powershell code that execute COM Objects

windows · ps_script

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

windows · process_creation

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

windows · file_event

Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.

windows · registry_set

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

windows · process_creation

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

linux

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

windows · file_event

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

windows · image_load

Detects creation of WMI event subscription persistence method

windows · wmi_event

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

windows

Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.

windows · process_creation

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

windows

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

windows · file_event

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

windows · process_creation