Harrison Pomeroy
@ZeroChill13 followers229 downloads43 copies57 likes1,188 views
8 detections
Filters
Last updated
All Time
Detection languages
6
2
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
MITRE Techniques
2
2
1
1
1
Detects the execution of rundll32.exe with davclnt.dll to establish a WebDAV connection, a technique used by APT42 in the SpearSpecter campaign for initial access via malicious search-ms links. Specifically, it looks for rundll32.exe executing the DavSetCookie function from davclnt.dll and captures the WebDAV server from the command line argument.
SPL Query from file: Enumeration of GCP Infrastructure
SPL Query from file: Beavertail Exfiltration over TCP
KQL Query from file: Changes in SymlinkEvaluation Behavior via fsutil
Detects when a Cloud Storage bucket's IAM policy is changed to add public access to all users.
Detects files with suspiciously structured names potentially related to stage 2 malware delivery, focusing on those that contain specific HTML and image file extensions. This is specifically related to known malware TTPs related to Qakbot.
The detection functionality is specifically on the zscaler a notable proxy, depending on the proxy technology being leveraged, this could perhaps be used for others.
The detection's focus is anchored what the HTTP content is, and its associated user-agent which is tied to MSHTA Execution. We couple these because using the user-agent alone, is too general resulting in a massive amount of events. Coupling the content focusing on HTA does in fact hone in on pulling an hta payload down into the environment.
mshta.exe (Microsoft HTML Application Host) is a legitimate Windows utility used to execute HTML Application (HTA) files and can also be used to run scripts, such as JavaScript or VBScript, directly from the command line. This technique involves abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts or commands by proxy. Since mshta.exe is Microsoft-signed, attackers use it to bypass security tools or avoid detection (a technique known as living off the land).
The detection's focus is anchored what the HTTP content is, and its associated user-agent which is tied to MSHTA Execution. We couple these because using the user-agent alone, is too general resulting in a massive amount of events. Coupling the content focusing on HTA does in fact hone in on pulling an hta payload down into the environment.
mshta.exe (Microsoft HTML Application Host) is a legitimate Windows utility used to execute HTML Application (HTA) files and can also be used to run scripts, such as JavaScript or VBScript, directly from the command line. This technique involves abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts or commands by proxy. Since mshta.exe is Microsoft-signed, attackers use it to bypass security tools or avoid detection (a technique known as living off the land).
The primary focus is to detect network access to administrative or system drive shares (C$, D$, E$, F$, U$, Admin$) while excluding local access (Event Code 5140). Specifically identifying remote session and other forms of login.
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.