TTP Search

T1548 T1134 T1134 T1134 T1087 T1087 T1557 T1071 T1560 T1547 T1547 T1547 T1217 T1115 T1059 T1059 T1059 T1136 T1136 T1543 T1555 T1484 T1482 T1114 T1573 T1546 T1041 T1567 T1567 T1068 T1210 T1083 T1615 T1574 T1574 T1574 T1574 T1574 T1070 T1105 T1056 T1056 T1106 T1046 T1135 T1040 T1027 T1003 T1057 T1055 T1021 T1021 T1053 T1113 T1518 T1558 T1558 T1082 T1016 T1049 T1569 T1127 T1552 T1552 T1550 T1125 T1102 T1047

Prestige ransomware IOCs Oct 2022

Privileged Role Assigned Outside PIM

Privilege Escalation

T1078

Privileged User Logon from new ASN

Identity Security Others

Defense Evasion

T1078

Probable AdFind Recon Tool Usage

Discovery

T1016 T1018 T1069 T1087 T1482

Probable AdFind Recon Tool Usage Normalized Process Events

Security Threat Intelligence

Discovery

T1018

Process Creation with Suspicious CommandLine Arguments

Execution Defense Evasion

T1059 T1027

Process executed from binary hidden in Base64 encoded file

Execution Defense Evasion

T1059 T1027 T1140

Process Execution Frequency Anomaly

Execution

T1059

Progress MOVEIt File transfer above threshold

Exfiltration

T1020

Progress MOVEIt File transfer folder count above threshold

Exfiltration

T1020

ProofpointPOD - Binary file in attachment

Initial Access

T1078

ProofpointPOD - Email sender in TI list

Exfiltration Initial Access

Radiflow - New Activity Detected

Initial Access

T1133 T0848

Security Threat Protection

Lateral Movement

T1021

Rare subscription-level operations in Azure

Credential Access Persistence

T1003 T1098

RDP Nesting

Security Threat Protection

Lateral Movement

T1021

RDS instance publicly exposed

Exfiltration

T1537

RecordedFuture Threat Hunting Domain All Actors

Initial Access Command and Control

T1566 T1568

RecordedFuture Threat Hunting Hash All Actors

Initial Access Execution Persistence

T1189 T1059 T1554

RecordedFuture Threat Hunting IP All Actors

Exfiltration Command and Control

T1041 T1568

RecordedFuture Threat Hunting Url All Actors

Persistence Privilege Escalation Defense Evasion

T1098 T1078

Red Canary Threat Detection

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Refactor AWS policy based on activities in the last 60 days

Privilege Escalation

T1078

Registries Alerts for Prancer

Reconnaissance

T1595

Registry Persistence via AppCert DLL Modification

Persistence

T1546

Registry Persistence via AppInit DLLs Modification

Persistence

T1546

Regsvr32 Rundll32 Image Loads Abnormal Extension

Defense Evasion

T1218 T1218

Regsvr32 Rundll32 with Anomalous Parent Process

Defense Evasion

T1218 T1218

Remote Desktop Network Brute force ASIM Network Session schema

Credential Access

T1110

Remote Desktop Protocol - SharpRDP

Lateral Movement

T1021

Remote File Creation with PsExec

Lateral Movement

T1570

Rename System Utilities

Defense Evasion

T1036

Request for single resource on domain

Command and Control

T1102 T1071

Response rows stateful anomaly on database

Exfiltration

T1537 T1567

Risky user signin observed in non-Microsoft network device

Security Threat Protection

Command and Control

T1071

RunningRAT request parameters

Samsung Knox - Mobile Device Boot Compromise Events

Persistence

T1645

Samsung Knox - Password Lockout Events

Credential Access

T1110

Samsung Knox - Peripheral Access Detection with Camera Events

Samsung Knox - Peripheral Access Detection with Mic Events

Samsung Knox - Security Log Full Events

Samsung Knox - Suspicious URL Accessed Events

Initial Access

T1566

SAP ETD - Login from unexpected network

Server Oriented Cmdlet And User Oriented Cmdlet used

Exfiltration Persistence Collection

T1020 T1098 T1114

Service Accounts Performing Remote PS

Lateral Movement

T1210

Service Principal Assigned App Role With Sensitive Access

Security Others Identity

Privilege Escalation

T1078

Service Principal Assigned Privileged Role

Security Others Identity

Privilege Escalation

T1078

Service Principal Authentication Attempt from New Country

Security Others Identity

Initial Access

T1078

Service Principal Name SPN Assigned to User Account

Sign-ins from IPs that attempt sign-ins to disabled accounts Uses Authentication Normalization

Initial Access Persistence

T1078 T1098

Silk Typhoon New UM Service Child Process

Security Threat Intelligence

Initial Access

T1190

Silk Typhoon Suspicious Exchange Request

Security Threat Intelligence

Initial Access

T1190

Silk Typhoon Suspicious File Downloads

Security 0 Day Vulnerability

Initial Access

T1190

Silk Typhoon Suspicious UM Service Error

Snowflake - Unusual query

Collection

T1119

Snowflake - User granted admin privileges

Privilege Escalation

T1078

Solorigate Defender Detections

Security 0 Day Vulnerability

Initial Access

T1195

Solorigate Named Pipe

Security 0 Day Vulnerability

Defense Evasion Privilege Escalation

T1055

SonicWall - Allowed SSH Telnet and RDP Connections

Initial Access Execution Persistence Credential Access Discovery Lateral Movement Collection Exfiltration Impact

T1190 T1133 T1059 T1110 T1003 T1087 T1018 T1021 T1005 T1048 T1041 T1011 T1567 T1490

SonicWall - Capture ATP Malicious File Detection

Execution

T1204

Sonrai Ticket Assigned

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Closed

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Escalation Executed

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Escalation Executed

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Reopened

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Risk Accepted

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Snoozed

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499

Sonrai Ticket Updated

Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation