Yamato Security Hayabusa
@YamatoSecurityHayabusa23 followers164,250 downloads303 copies5 likes55,514 views
4,504 detections
Filters
Last updated
All Time
Detection languages
4,504
Categories
2,724
432
211
185
125
Platforms
4,504
Products / Services
185
78
30
24
10
MITRE Techniques
2,153
1,271
970
844
414
Detects default file names outputted by the BloodHound collection tool SharpHound
Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
Detects the execution of whoami.exe with suspicious parent processes.
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
Detects Remote Utilities Host service installation on the target system.
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Detects PsExec service execution via default service image name
Detect suspicious Kerberos TGT requests.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Detects creation of local users via the net.exe command with the name of "DarkGate"
Page 11 of 451