Develop Capabilities detection rulesT1587

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

windows · file_event

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

windows · image_load

Detects the execution of the PurpleSharp adversary simulation tool

windows · process_creation

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

windows

Detects a command used by conti to find volume shadow backups

windows · process_creation

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

windows · process_creation

Detects known hacktool execution based on image name.

linux · process_creation

Detects specific process parameters as used by Mustang Panda droppers

windows · process_creation

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

windows · process_creation

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

windows · process_creation

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

windows · process_creation

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

windows · process_creation

Detects file creation patterns noticeable during the exploitation of CVE-2021-40444

windows · file_event

Detects the creation of a file with an uncommon extension in an Office application startup folder

windows · file_event

Detects program executions in suspicious non-program folders related to malware or hacking activity

linux

Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.

windows · file_event

Detects the creation of an executable by another executable.

windows · file_event