Threat Scout
@ThreatScoutCompletionist
0 followers11 downloads62 copies13 likes1,044 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
1
Platforms
2
1
Products / Services
2
1
MITRE Techniques
1
1
1
1
1
Detects potential DC Sync attacks, where an adversary mimics a domain controller to request credential data using replication permissions. This rule identifies Event ID 4662 with AccessMask 0x100 and specific replication-related properties, excluding known benign accounts.
Adversaries often use malicious macros embedded in Office documents (Word, Excel) to execute payloads often spawning PowerShell, cmd, or LOLBins. This rule detects macro-triggered process chains indicative of weaponized documents.
Identifies Ingress Tool Transfer's.