Anandakumar Sivanandam
@AndywkCompletionist
1 follower38 downloads198 copies2 likes1,967 views
13 detections
Filters
Last updated
All Time
Detection languages
13
Categories
2
1
1
1
1
Platforms
13
1
1
Products / Services
6
1
MITRE Techniques
2
2
2
1
1
IDS Classtypes
3
2
This use case detects when shares are mapped via "net.exe" within command line. More specifically, hidden administrative shares that can be mapped and used to remote file copy malicious files and/or executables.
This query identifies single character file names used at point of execution or in command line arguments with optional logic to look for the file creations.
This use case is meant to identify Run registry key modifications which point to a file located within the "C:\Users\Public" folder.
Page 2 of 2