Tim P
@bobbyTablezCompletionist
3 followers422 downloads34 copies17 likes806 views
13 detections
Filters
Last updated
All Time
Detection languages
11
1
1
Categories
5
3
2
1
1
Platforms
11
1
Products / Services
4
4
3
1
MITRE Techniques
5
3
3
3
2
Detects highly unusual network connections initiated by notepad.exe. This behavior is suspicious because notepad.exe is a simple text editor not designed for network communication. This technique has been observed in campaigns where threat actors inject shellcode into a suspended notepad.exe process to establish command and control (C2) connections.
The SID S-1-5-32-544 refers to the builtin "Administrators" group on a local Windows machine. Threat actors will often reference this SID rather than the group name in order to obfuscate their actions. References to the SID rather than the group name should be considered unusual.
This rule looks for the usage of the torsocks process which can be used by threat actors to proxy connections through the Tor network to exfiltrate data or download further payloads. The usage of this process should always be considered suspicious.
Page 2 of 2