Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
1 follower58 downloads6 copies0 likes161 views
58 detections
Filters
Last updated
All Time
Detection languages
58
Categories
39
7
4
3
2
Platforms
54
3
2
1
1
Products / Services
45
38
3
1
1
MITRE Techniques
25
19
14
13
11
CVEs
1
Detects attempts to enumerate Active Directory user objects using the Get-ADUser cmdlet with wildcard filters. This technique is often employed by attackers to gather information about user accounts and their attributes.
Detects attempts to identify the domain membership of a system using WMI queries to the Win32_ComputerSystem class. This technique is often employed by attackers to gather information about the network environment and potential targets.
Detects attempts to enumerate DNS zone records using the Get-DnsServerResourceRecord cmdlet. This technique is often employed by attackers to gather information about DNS configurations and potential targets within a network.
Detects attempts to enumerate Active Directory computer objects using the Get-ADComputer cmdlet with wildcard filters. This technique is often employed by attackers to gather information about networked devices and their configurations.
Detects attempts to enumerate Active Directory replication subnets using the Get-ADReplicationSubnet cmdlet. This technique is often employed by attackers to gather information about the network topology and potential targets within a domain.
Detects msiexec.exe-associated registry activity involving Chrome or Edge installation paths, matching msaRAT browser discovery before it launches a headless CDP session.
Detects lib.dll being loaded by msiexec.exe, an unusual image-load relationship that matches the embedded MSI custom action used by msaRAT.
This rule attempts to detect the command flags from the msaRAT.
The rule attempts to detect the use of powershell to exec "officoprotocolo", which was part of the PhatomEnigma campaign
Detects .NET executables created in the Windows temp staging
directory C:\windows\temp\s\, a known Agrius wiper deployment location.
directory C:\windows\temp\s\, a known Agrius wiper deployment location.
Page 5 of 6