Sergio Albea
@Sergio_AlbeaTrusted contributorCompletionist
15 followers230 downloads2,155 copies99 likes17,300 views
73 detections
Filters
Last updated
All Time
Detection languages
73
Categories
11
11
9
8
7
Platforms
39
18
8
8
7
Products / Services
32
18
5
4
3
MITRE Techniques
14
12
11
10
9
CVEs
1
1
1
1
Amcache.hve is a Windows registry file that logs details about executed programs, including file paths, hashes, timestamps, and metadata. It helps reconstruct what was run on a system—even if the original file is gone. On the other hand, Shimcache is a memory-resident registry artifact that records executables seen or run by the system. It stores file paths and last modified timestamps, making it useful for tracking historical program execution—even after deletion. Attackers aware of forensic techniques could try to delete or alter these files to remove the evidences of their attacks:
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
The ZoneMap key under Internet Settings is used to define security zones for specific domains. By setting a value under ZoneMap\Domains, you are configuring how Windows handles security and permissions for that domain so it is really helpful to identify if some site has been added via cli manually or by some malicious script to whitelist some domains and bypass some defense.
On environments managing sensible or critical information, I am not really happy when their local device configuration are modified and their network rely on airports, hotels, or the nearest coffee shop's Wi-Fi. This Query review if the TCPIP register is modified and it DHCP Domain is managed by a non-trusted/known network. It would help to restrict their access to enterprise data until be 100% sure they are using a VPN or back to enterprise DHCP Domain.
KQL Query
The following query is oriented to extend information about the potential threats associated with distinct HTTP status code. This allows me to quickly work with other KQL queries to identify potential threats. Consider this KQL query as a "Pivot Table" for multiple queries that can be triggered based on your criteria.
Detecting networks shared by phones with key words in their Names such as "FREE", "AIRPORT" "OPEN", can be potential cases of Evil Twin Attack where malicious actors can intercept network traffic, steal login credentials, capture sensitive data, or launch further attacks like Man-in-the-Middle (MitM) attacks.
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
New forensic techniques helps to have more insights about RDP-based attacks.By analyzing login sequences, screen tile caches, clipboard data, and session memory, analysts can now reconstruct full attacker activity during Remote Desktop sessions—even if the adversary tries to cover their tracks.
The following KQL Query helps to identify when a ransomware attack attempts to remove the mentioned evidence via script which will be identified as executed command.
The following KQL Query helps to identify when a ransomware attack attempts to remove the mentioned evidence via script which will be identified as executed command.
This query look for PnP devices connected or allowed into Endpoint machines. Basically, you can use the action types "PnpDeviceConnected" / "PnpDeviceConnected" to have a list of PnP devices connected to your endpoints and it helps with some concerns such as:
1. Keeping an eye out for PnP devices like USB drives or external disks being connected to critical servers (like DC's, Exchange servers, or any machine with sensitive info).
2. If I’m handling sensitive info that shouldn’t be shared or printed, I want to make sure no printers are connected to my endpoints
3. Spotting unfamiliar devices from unknown vendors
4. Finding PnP devices that might be out of date and need attention
1. Keeping an eye out for PnP devices like USB drives or external disks being connected to critical servers (like DC's, Exchange servers, or any machine with sensitive info).
2. If I’m handling sensitive info that shouldn’t be shared or printed, I want to make sure no printers are connected to my endpoints
3. Spotting unfamiliar devices from unknown vendors
4. Finding PnP devices that might be out of date and need attention
Another common behaviour is dropping ransom notes in the 'C:\Users\Public' folder to notify about the encryption and the details for the corresponding payments. I recommend you to execute this KQL query to see if you have some false positive to whitelist them as I have with .lnk files ( basically browser shortcuts)
A typical technique used by ransomware operators is the deletion of Prefetch files, which track recently executed programs .
By running commands like 'del C:\Windows\Prefetch\*.pf', attackers attempt to erase forensic traces of tools they’ve used. This behavior is aimed at hindering investigation and slowing down incident response.
By running commands like 'del C:\Windows\Prefetch\*.pf', attackers attempt to erase forensic traces of tools they’ve used. This behavior is aimed at hindering investigation and slowing down incident response.
Page 7 of 8