Exploitation for Stealth T1211
Tactic: Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
Events covered
8 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Application-Error | Event ID 1000 | Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name. |
| Defender-DeviceFileEvents | FileRenamed | File renamed |
| ESF | rename | File Rename |
| ESF | write | File Write |
| Audit-CVE | Event ID 1 | Possible detection of CVE: PossibleDetectionOfCVE. |
| Windows-Error-Reporting | Event ID 1001 | Fault bucket , type. |
Authoring guide
These 27 rules share fields, values, and exclusions.
Fields filtered most (41 distinct)
These fields appear most often in rule filters.
Top indicator values (162 distinct)
These values appear most often in rule predicates.
Exclusions (151 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 4 rules
- Audit CVE Event
- Microsoft Malware Protection Engine Crash
- Microsoft Malware Protection Engine Crash - WER
- Writing Of Malicious Files To The Fonts Folder
Elastic 14 rules
- Egress Network Connection from Deleted Executable by Root
- Linux Hidden File Mounted
- LSASS Memory Read via PPL Bypass
- MacOS Hidden File Mounted
- Potential Defense Evasion via PRoot
- Potential DLL Hollowing from a Writable Image
- Potential Exploit via Fake RPC Messages
- Potential Protected Process DLL Injection via RPC
- Protected Process from Unusual Parent
- Protected Process Light Bypass via DLL Tampering
- Suspicious DMG File Creation in Tmp Directory
- Suspicious Image Load by System Protected Process
- Unusual Executable File Creation by a System Critical Process
- Unusual Process Running as Antimalware Protected
Splunk 4 rules
- Conhost.exe Kernel call (Sysmon)
- Conhost.exe Kernel call (Windows Event Log)
- Suspicious Conhost.exe Commands (Sysmon)
- Suspicious Conhost.exe Commands (Windows Event Log)