John D.
@LasCC1 follower8 downloads32 copies1 like296 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
Platforms
2
Products / Services
2
2
MITRE Techniques
2
1
1
1
This rule detects suspicious use of the Windows clipboard utility (clip.exe) or the "| clip" command pattern during RDP sessions. This behaviour is commonly associated with automated command execution and data exfiltration techniques, such as those used by NetExec. Legitimate use of clip.exe in remote sessions is rare, so these events may indicate lateral movement or post-exploitation activity via RDP.
https://github.com/Pennyw0rth/NetExec/pull/676/commits/f17f091d6b99be917ea7afca85d679b80cab7d49
https://github.com/Adamkadaban/NetExec/blob/rdp-exec/nxc/protocols/rdp.py#L412
https://github.com/Pennyw0rth/NetExec/pull/676/commits/f17f091d6b99be917ea7afca85d679b80cab7d49
https://github.com/Adamkadaban/NetExec/blob/rdp-exec/nxc/protocols/rdp.py#L412
SMBExec was Used
S1QL
Detects potential attempts to access administrative shares using cmd.exe or powershell.exe, which could indicate lateral movement or unauthorized access attempts.