Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads950 copies13 likes34,079 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Detects abuse of comsvcs.dll MiniDump export to dump LSASS or other process memory
for credential access.
for credential access.
Detects credential dumping of the TermService svchost process that can retain plaintext
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Process Data as source
File running from Recycle Bin
File running from Recycle Bin
Page 2 of 38