Stanislas MEDRANO
@stanfrbd0 followers13 downloads28 copies2 likes729 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
2
1
1
Platforms
2
2
Products / Services
2
1
MITRE Techniques
1
1
1
1
1
CVEs
1
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
This rule detects when an MDI (Microsoft Defender for Identity) sensor is deleted. This could indicate an adversary attempting to impair defenses by removing security monitoring tools.
This rule detects when an MDE offboarding package is downloaded.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.