Exploitation for Stealth T1211

Tactic: Stealth

Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.

Events covered

8 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 27 rules share fields, values, and exclusions.

Fields filtered most (41 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType9eq 7, in 2start, end, exec, ProcessRollup2, connection_attempted
CommandLine5regex_match 4, contains 1(?i)conhost\.exe.*?\.exe, ^\S+\s, conhost.exe 0xffffffff -ForceV1, .bat, .bin
event.type4eq 3, ne 1start, deletion
process.Ext.protection4starts_with 2, eq 1, is_not_null 1, ne 1PsProtectedSignerAntimalware-Light, PsProtected, PsProtectedSigner
EventID3eq 34688, 1
Provider_Name3eq 3application error, audit-cve, microsoft-windows-audit-cve, windows error reporting
dll.Ext.defense_evasions3eq 3process tampering: code integrity violation, process tampering: image has been accessed before mapping, process tampering: image has write sharing, process tampering: image is writable
parent_process_name3eq 2, in 1excel.exe, explorer.exe, msbuild.exe, outlook.exe, powerpnt.exe
process_name3eq 3, in 1autochk.exe, csrss.exe, diskimages-helper, logonui.exe, lsblk
Action2eq 2Blocked, Matched, vulnerabilityAlert
Category2eq 2ApplicationGatewayFirewallLog, frontdoorwebapplicationfirewalllog
Data2contains 2mpengine.dll, msmpeng.exe
Image2ends_with 1, is_not_null 1 (deleted)
TargetFilename2starts_with 2/private/tmp/, /private/tmp/., /tmp/
Total_TransactionId2ge 23

Top indicator values (162 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
start
4391
EventTypeeq
end
218
event.typeeq
start
31078
CommandLineregex_match
(?i)conhost\.exe.*?\.exe
22
CommandLineregex_match
^\S+\s
22
CommandLineregex_match
conhost.exe 0xffffffff -ForceV1
22
Datacontains
mpengine.dll
22
Datacontains
msmpeng.exe
22
EventIDeq
4688
2317
Total_TransactionIdge
3
26
dll.Ext.defense_evasionseq
process tampering: code integrity violation
22
Actioneq
Blocked
15
Actioneq
Matched
15
Actioneq
vulnerabilityAlert
1
ActionTypeeq
FileRenamed
12
Blocked_Reasoncontains
sql injection attack
1
Categoryeq
ApplicationGatewayFirewallLog
12
Categoryeq
frontdoorwebapplicationfirewalllog
14
CommandLinecontains
.bat
111
CommandLinecontains
.bin
1
CommandLinecontains
.cmd
16
CommandLinecontains
.cpl
13
CommandLinecontains
.dll
116
CommandLinecontains
.exe
15
CommandLinecontains
.hta
16
CommandLinecontains
.inf
14
CommandLinecontains
.jar
12
CommandLinecontains
.js
19
CommandLinecontains
.msh
1
CommandLinecontains
.msi
1

Exclusions (151 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Hasheseq
00af34a5cca727b768d6030ca15e0f728e5855c23c73c78712aaee69fa14b489
1
Hasheseq
0c8809a707a34414a2169138bb8749e22fc5437d533c538cff9480a13b768ec5
1
Hasheseq
0f5521daedebfbb0b2f000510a36f9b01364d6dfbd2c983fe9ba7ff52d5bf0a9
1
Hasheseq
128ae380509edbf0b17bb8a01110df57e310ec11dba9e9c6e5708098d6603247
1
Hasheseq
14da1fbca85ff2b8ac19ab63f4b7019614865ce8d87bce68100c97174b786ff5
1
Hasheseq
3153fd9425111477a2dd15921eb13b2fc98210b5e59ce93238e4cec10ebd30a9
1
Hasheseq
390b87da25c2b894adab6b8de4756ae5c5c8c3438d00681b138c2bcf812807f2
1
Hasheseq
399ae476e53ad179f6238c0b7c8235d830490b0dbab981ac77ee73c4b35cf095
1
Hasheseq
40eb09efd0fd767c665cd23360ece6a106e25d5bb692dcd16c63fe8ff1d29079
1
Hasheseq
42db05ee12cb94a0bc3676831f915bfbd71927a5bd2561a051c275038ba3f0ad
1
Hasheseq
46f3db2d2f869c9c4273176ca9b14249b0cd7c15c6dbcfc6e09dc5498030ffa9
1
Hasheseq
545a3aec876c49c56693f48f5fde740487330ca097775d9a434157aabf25db10
1
Hasheseq
5a53be7287634f941e18ea3496ada9b336294311cd50bb4c02ec8d51cbdf4555
1
Hasheseq
5d59d9f32b8f1c4e5161714f1f07bd366f6c71c0ef72a7b7e66e4ac58f646ecd
1
Hasheseq
600b4ddc2fae87aaa400992c8ea4998908651900345d0b18d9b7d1ce916e02a4
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 4 rules

Elastic 14 rules

Splunk 4 rules

Kusto 5 rules