{"blocks":{"eir-block-01":"
Remote File Download via MpCmdRun mediumRelated:
\n
Remote Management Access Launch After MSI Install mediumRelated:
\n
NetSupport Manager Execution from an Unusual Path highRelated:
\n
Suspicious ScreenConnect Client Child Process mediumRelated:
\n
Potential File Transfer via Curl for Windows low
\n
Potential Protocol Tunneling via Cloudflared mediumRelated:
\n
Attempt to Establish VScode Remote Tunnel mediumRelated:
\n
Potential Protocol Tunneling via Yuze mediumRelated:
\n
Suspicious Shell Execution via Velociraptor mediumRelated:
\n
Browser Process Spawned from an Unusual Parent highRelated:
\n
Potential Credential Access via Windows Utilities highRelated:
\n
NTDS or SAM Database File Copied highRelated:
\n
Credential Acquisition via Registry Hive Dumping highRelated:
\n
Microsoft IIS Connection Strings Decryption highRelated:
\n
Potential Local NTLM Relay via HTTP highRelated:
\n
Searching for Saved Credentials via VaultCmd mediumRelated:
\n
Symbolic Link to Shadow Copy Created mediumRelated:
\n
Potential Veeam Credential Access Command mediumRelated:
\n
NTDS Dump via Wbadmin mediumRelated:
\n
Wireless Credential Dumping using Netsh Command highRelated:
\n
Adding Hidden File Attribute via Attrib lowRelated:
\n
Clearing Windows Console History mediumRelated:
\n
Clearing Windows Event Logs lowRelated:
\n
Code Signing Policy Modification Through Built-in tools mediumRelated:
\n
Windows Defender Exclusions Added via PowerShell mediumRelated:
\n
Delete Volume USN Journal with Fsutil lowRelated:
\n
Disable Windows Firewall Rules via Netsh mediumRelated:
\n
Disabling Windows Defender Security Settings via PowerShell mediumRelated:
\n
Disable Windows Event and Security Logs Using Built-in Tools lowRelated:
\n
Suspicious .NET Code Compilation mediumRelated:
\n
Remote Desktop Enabled in Windows Firewall by Netsh mediumRelated:
\n
Enable Host Network Discovery via Netsh mediumRelated:
\n
Control Panel Process with Unusual Arguments highRelated:
\n
ImageLoad via Windows Update Auto Update Client mediumRelated:
\n
Microsoft Build Engine Started by an Office Application highRelated:
\n
Microsoft Build Engine Started by a System Process mediumRelated:
\n
Process Execution from an Unusual Directory mediumRelated:
\n
IIS HTTP Logging Disabled highRelated:
\n
Proxy Execution via Console Window Host highRelated:
\n
Command Execution via ForFiles mediumRelated:
\n
Proxy Execution via Windows OpenSSH highRelated:
\n
Execution via Windows Command Debugging Utility mediumRelated:
\n
Suspicious Endpoint Security Parent Process mediumRelated:
\n
Program Files Directory Masquerading mediumRelated:
\n
System File Ownership Change mediumRelated:
\n
Suspicious Microsoft HTML Application Child Process highRelated:
\n
Potential Remote Install via MsiExec highRelated:
\n
Command Obfuscation via Unicode Modifier Letters highRelated:
\n
Windows Firewall Disabled via PowerShell mediumRelated:
\n
Script Execution via Microsoft HTML Application highRelated:
\n
Suspicious CertUtil Commands mediumRelated:
\n
Suspicious Zoom Child Process mediumRelated:
\n
Unusual Child Process from a System Virtual Process highRelated:
\n
Potential Evasion via Filter Manager mediumRelated:
\n
Signed Proxy Execution via MS Work Folders mediumRelated:
\n
Execution via Windows Subsystem for Linux mediumRelated:
\n
Windows Subsystem for Linux Enabled via Dism Utility mediumRelated:
\n
Attempt to Install Kali Linux via WSL highRelated:
\n
Active Directory Discovery using AdExplorer lowRelated:
\n
AdFind Command Activity lowRelated:
\n
Enumeration of Administrator Accounts low
\n
Enumerating Domain Trusts via DSQUERY.EXE lowRelated:
\n
Enumerating Domain Trusts via NLTEST.EXE lowRelated:
\n
Group Policy Discovery via Microsoft GPResult Utility lowRelated:
\n
Peripheral Device Discovery lowRelated:
\n
Whoami Process Activity low
\n
Command Execution via SolarWinds Process mediumRelated:
\n
Execution of COM object via Xwizard mediumRelated:
\n
Enumeration Command Spawned via WMIPrvSE lowRelated:
\n
Execution from Unusual Directory - Command Line mediumRelated:
\n
Potential Foxmail Exploitation highRelated:
\n
Mofcomp Activity low
\n
Suspicious Execution with NodeJS highRelated:
\n
Command and Scripting Interpreter via Windows Scripts highRelated:
\n
Suspicious Execution from a WebDav Share highRelated:
\n
Windows Script Execution from Archive mediumRelated:
\n
Suspicious JavaScript Execution via Deno highRelated:
\n
Suspicious Cmd Execution via WMI highRelated:
\n
Suspicious PDF Reader Child Process lowRelated:
\n
Process Activity via Compiled HTML File mediumRelated:
\n
Microsoft Management Console File from Unusual Path mediumRelated:
\n
Suspicious Windows Command Shell Arguments highRelated:
\n
Potential Fake CAPTCHA Phishing Attack highRelated:
\n
Suspicious Windows Powershell Arguments mediumRelated:
\n
Potential Data Exfiltration via Rclone mediumRelated:
\n
Backup Deletion with Wbadmin lowRelated:
\n
Modification of Boot Configuration lowRelated:
\n
Volume Shadow Copy Deleted or Resized via VssAdmin highRelated:
\n
Volume Shadow Copy Deletion via PowerShell highRelated:
\n
Volume Shadow Copy Deletion via WMIC highRelated:
\n
Suspicious Execution from INET Cache highRelated:
\n
Suspicious JetBrains TeamCity Child Process mediumRelated:
\n
Remote Desktop File Opened from Suspicious Path mediumRelated:
\n
Microsoft Exchange Server UM Spawning Suspicious Processes mediumRelated:
\n
Suspicious MS Office Child Process mediumRelated:
\n
Suspicious MS Outlook Child Process lowRelated:
\n
ScreenConnect Server Spawning Suspicious Processes highRelated:
\n
Execution via TSClient Mountpoint highRelated:
\n
Mounting Hidden or WebDav Remote Shares mediumRelated:
\n
Remote File Copy to a Hidden Share mediumRelated:
\n
Unusual Child Process of dns.exe highRelated:
\n
Potential WSUS Abuse for Lateral Movement mediumRelated:
\n
New ActiveSyncAllowedDeviceID Added via PowerShell mediumRelated:
\n
System Shells via Services mediumRelated:
\n
User Account Creation lowRelated:
\n
Potential Application Shimming via Sdbinst lowRelated:
\n
Persistence via TelemetryController Scheduled Task Hijack highRelated:
\n
Persistence via Update Orchestrator Service Hijack highRelated:
\n
Persistence via WMI Event Subscription lowRelated:
\n
Process Creation via Secondary Logon mediumRelated:
\n
Privilege Escalation via Named Pipe Impersonation highRelated:
\n
Service Control Spawned via Script Interpreter low
\n
UAC Bypass via DiskCleanup Scheduled Task Hijack mediumRelated:
\n
Bypass UAC via Event Viewer highRelated:
\n
UAC Bypass Attempt via Windows Directory Masquerading highRelated:
\n
Potential Exploitation of an Unquoted Service Path Vulnerability lowRelated:
\n
Unusual Parent-Child Relationship mediumRelated:
\n
Unusual Print Spooler Child Process medium
\n","eir-block-02":"
Suspicious React Server Child Process high
\n
Exporting Exchange Mailbox via PowerShell mediumRelated:
\n
Encrypting Files with WinRar or 7z medium
\n
Potential File Transfer via Certreq mediumRelated:
\n
Potential DNS Tunneling via NsLookup mediumRelated:
\n
Potential File Download via a Headless Browser highRelated:
\n
Potential Command and Control via Internet Explorer mediumRelated:
\n
Potential Remote Desktop Tunneling Detected highRelated:
\n
Remote File Download via Desktopimgdownldr Utility mediumRelated:
\n
Remote File Download via MpCmdRun mediumRelated:
\n
Remote Management Access Launch After MSI Install mediumRelated:
\n
NetSupport Manager Execution from an Unusual Path highRelated:
\n
Suspicious ScreenConnect Client Child Process mediumRelated:
\n
Potential Protocol Tunneling via Cloudflared mediumRelated:
\n
Attempt to Establish VScode Remote Tunnel mediumRelated:
\n
Potential Protocol Tunneling via Yuze mediumRelated:
\n
Suspicious Shell Execution via Velociraptor mediumRelated:
\n
Browser Process Spawned from an Unusual Parent highRelated:
\n
Potential Credential Access via Windows Utilities highRelated:
\n
NTDS or SAM Database File Copied highRelated:
\n
Potential Credential Access via Trusted Developer Utility high
\n
Credential Acquisition via Registry Hive Dumping highRelated:
\n
Microsoft IIS Connection Strings Decryption highRelated:
\n
Potential Local NTLM Relay via HTTP highRelated:
\n
Searching for Saved Credentials via VaultCmd mediumRelated:
\n
Symbolic Link to Shadow Copy Created mediumRelated:
\n
Potential Veeam Credential Access Command mediumRelated:
\n
NTDS Dump via Wbadmin mediumRelated:
\n
Wireless Credential Dumping using Netsh Command highRelated:
\n
Adding Hidden File Attribute via Attrib lowRelated:
\n
Clearing Windows Console History mediumRelated:
\n
Clearing Windows Event Logs lowRelated:
\n
Code Signing Policy Modification Through Built-in tools mediumRelated:
\n
Suspicious Communication App Child Process medium
\n
Windows Defender Exclusions Added via PowerShell mediumRelated:
\n
Delete Volume USN Journal with Fsutil lowRelated:
\n
Disable Windows Firewall Rules via Netsh mediumRelated:
\n
Disabling Windows Defender Security Settings via PowerShell mediumRelated:
\n
Disable Windows Event and Security Logs Using Built-in Tools lowRelated:
\n
Suspicious .NET Code Compilation mediumRelated:
\n
Remote Desktop Enabled in Windows Firewall by Netsh mediumRelated:
\n
Enable Host Network Discovery via Netsh mediumRelated:
\n
Control Panel Process with Unusual Arguments highRelated:
\n
ImageLoad via Windows Update Auto Update Client mediumRelated:
\n
Microsoft Build Engine Started by an Office Application highRelated:
\n
Microsoft Build Engine Started by a System Process mediumRelated:
\n
Microsoft Build Engine Using an Alternate Name low
\n
Potential DLL Side-Loading via Trusted Microsoft Programs medium
\n
Suspicious Microsoft Antimalware Service Execution high
\n
Process Execution from an Unusual Directory mediumRelated:
\n
IIS HTTP Logging Disabled highRelated:
\n
Proxy Execution via Console Window Host highRelated:
\n
Command Execution via ForFiles mediumRelated:
\n
Proxy Execution via Windows OpenSSH highRelated:
\n
InstallUtil Process Making Network Connections mediumRelated:
\n
Execution via Windows Command Debugging Utility mediumRelated:
\n
Suspicious Endpoint Security Parent Process mediumRelated:
\n
Potential Masquerading as Business App Installer low
\n
Potential Masquerading as Communication Apps medium
\n
Renamed Automation Script Interpreter high
\n
Suspicious WerFault Child Process medium
\n
Program Files Directory Masquerading mediumRelated:
\n
Potential Windows Error Manager Masquerading mediumRelated:
\n
Network Connection via Signed Binary lowRelated:
\n
System File Ownership Change mediumRelated:
\n
MsBuild Making Network Connections mediumRelated:
\n
Mshta Making Network Connections mediumRelated:
\n
Suspicious Microsoft HTML Application Child Process highRelated:
\n
MsiExec Service Child Process With Network Connection mediumRelated:
\n
Potential Remote Install via MsiExec highRelated:
\n
Network Connection via MsXsl lowRelated:
\n
Unusual Network Activity from a Windows System Binary mediumRelated:
\n
Command Obfuscation via Unicode Modifier Letters highRelated:
\n
Parent Process PID Spoofing high
\n
Windows Firewall Disabled via PowerShell mediumRelated:
\n
Suspicious Microsoft Diagnostics Wizard Execution high
\n
Windows Sandbox with Sensitive Configuration medium
\n
Unusual Child Processes of RunDLL32 high
\n
Service DACL Modification via sc.exe medium
\n
Script Execution via Microsoft HTML Application highRelated:
\n
Suspicious CertUtil Commands mediumRelated:
\n
Suspicious Execution from a Mounted Device medium
\n
Renamed Utility Executed with Short Program Name medium
\n
Suspicious WMIC XSL Script Execution medium
\n
Suspicious Zoom Child Process mediumRelated:
\n
Unusual Process Execution Path - Alternate Data Stream medium
\n
Unusual Network Connection via DllHost mediumRelated:
\n
Unusual Network Connection via RunDLL32 mediumRelated:
\n
Unusual Process Network Connection lowRelated:
\n
Unusual Child Process from a System Virtual Process highRelated:
\n
Potential Evasion via Filter Manager mediumRelated:
\n
Signed Proxy Execution via MS Work Folders mediumRelated:
\n
Suspicious Execution via Windows Subsystem for Linux low
\n
Execution via Windows Subsystem for Linux mediumRelated:
\n
Windows Subsystem for Linux Enabled via Dism Utility mediumRelated:
\n
Host File System Changes via Windows Subsystem for Linux mediumRelated:
\n
Attempt to Install Kali Linux via WSL highRelated:
\n
Active Directory Discovery using AdExplorer lowRelated:
\n
AdFind Command Activity lowRelated:
\n
Enumerating Domain Trusts via DSQUERY.EXE lowRelated:
\n
Enumerating Domain Trusts via NLTEST.EXE lowRelated:
\n
Group Policy Discovery via Microsoft GPResult Utility lowRelated:
\n
Peripheral Device Discovery lowRelated:
\n
Command Execution via SolarWinds Process mediumRelated:
\n
Suspicious SolarWinds Child Process medium
\n
Execution of COM object via Xwizard mediumRelated:
\n
Suspicious Command Prompt Network Connection lowRelated:
\n
Unusual Parent Process for cmd.exe medium
\n
Command Shell Activity Started via RunDLL32 low
\n
Enumeration Command Spawned via WMIPrvSE lowRelated:
\n
Execution from Unusual Directory - Command Line mediumRelated:
\n
Network Connection via Compiled HTML File lowRelated:
\n
Potential Foxmail Exploitation highRelated:
\n
Unusual Execution via Microsoft Common Console File high
\n
Execution of File Written or Modified by Microsoft Office highRelated:
\n
Suspicious Execution with NodeJS highRelated:
\n
Potential Notepad Markdown RCE Exploitation high
\n
Command and Scripting Interpreter via Windows Scripts highRelated:
\n
PsExec Network Connection lowRelated:
\n
Potential Command Shell via NetCat high
\n
Suspicious Execution from a WebDav Share highRelated:
\n
Windows Script Execution from Archive mediumRelated:
\n
Suspicious JavaScript Execution via Deno highRelated:
\n
Suspicious Cmd Execution via WMI highRelated:
\n
Suspicious PDF Reader Child Process lowRelated:
\n
Suspicious Process Execution via Renamed PsExec Executable medium
\n
Process Activity via Compiled HTML File mediumRelated:
\n
Conhost Spawned By Suspicious Parent Process high
\n
Microsoft Management Console File from Unusual Path mediumRelated:
\n
Suspicious Windows Command Shell Arguments highRelated:
\n
Potential Fake CAPTCHA Phishing Attack highRelated:
\n
Potential Execution via FileFix Phishing Attack high
\n
Suspicious Windows Powershell Arguments mediumRelated:
\n
Execution of a Downloaded Windows Script mediumRelated:
\n
Potential Data Exfiltration via Rclone mediumRelated:
\n
Backup Deletion with Wbadmin lowRelated:
\n
Modification of Boot Configuration lowRelated:
\n
Volume Shadow Copy Deleted or Resized via VssAdmin highRelated:
\n
Volume Shadow Copy Deletion via PowerShell highRelated:
\n
Volume Shadow Copy Deletion via WMIC highRelated:
\n
Suspicious Execution from INET Cache highRelated:
\n
Suspicious Execution via Microsoft Office Add-Ins medium
\n
Suspicious JetBrains TeamCity Child Process mediumRelated:
\n
Remote Desktop File Opened from Suspicious Path mediumRelated:
\n
Windows Script Executing PowerShell low
\n
Windows Script Interpreter Executing Process via WMI medium
\n
Microsoft Exchange Server UM Spawning Suspicious Processes mediumRelated:
\n
Microsoft Exchange Worker Spawning Suspicious Processes high
\n
Suspicious MS Office Child Process mediumRelated:
\n
Suspicious MS Outlook Child Process lowRelated:
\n
Windows Server Update Service Spawning Suspicious Processes high
\n
Potential CVE-2025-33053 Exploitation high
\n
Suspicious Explorer Child Process medium
\n
ScreenConnect Server Spawning Suspicious Processes highRelated:
\n
Service Command Lateral Movement lowRelated:
\n
Incoming DCOM Lateral Movement via MSHTA highRelated:
\n
Incoming DCOM Lateral Movement with MMC highRelated:
\n
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows mediumRelated:
\n
SMB Connections via LOLBin or Untrusted Process mediumRelated:
\n
Execution via TSClient Mountpoint highRelated:
\n
Remote Execution via File Shares mediumRelated:
\n
Incoming Execution via WinRM Remote Shell mediumRelated:
\n
Mounting Hidden or WebDav Remote Shares mediumRelated:
\n
Incoming Execution via PowerShell Remoting mediumRelated:
\n
Potential SharpRDP Behavior highRelated:
\n
Remote File Copy to a Hidden Share mediumRelated:
\n
Remotely Started Services via RPC mediumRelated:
\n
Unusual Child Process of dns.exe highRelated:
\n
Potential WSUS Abuse for Lateral Movement mediumRelated:
\n
New ActiveSyncAllowedDeviceID Added via PowerShell mediumRelated:
\n
Potential Modification of Accessibility Binaries high
\n
Execution of Persistent Suspicious Program medium
\n
Startup Folder Persistence via Unsigned Process mediumRelated:
\n
Suspicious Execution via Scheduled Task medium
\n
System Shells via Services mediumRelated:
\n
User Account Creation lowRelated:
\n
Potential Application Shimming via Sdbinst lowRelated:
\n
Persistence via BITS Job Notify Cmdline medium
\n
Persistence via TelemetryController Scheduled Task Hijack highRelated:
\n
Persistence via Update Orchestrator Service Hijack highRelated:
\n
Persistence via WMI Event Subscription lowRelated:
\n
Potential Privilege Escalation via InstallerFileTakeOver high
\n
Potential Escalation via Vulnerable MSI Repair high
\n
Privilege Escalation via Named Pipe Impersonation highRelated:
\n
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface high
\n
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer medium
\n
UAC Bypass via ICMLuaUtil Elevated COM Interface high
\n
UAC Bypass via DiskCleanup Scheduled Task Hijack mediumRelated:
\n
Bypass UAC via Event Viewer highRelated:
\n
UAC Bypass Attempt via Windows Directory Masquerading highRelated:
\n
UAC Bypass via Windows Firewall Snap-In Hijack medium
\n
Potential Exploitation of an Unquoted Service Path Vulnerability lowRelated:
\n
Unusual Parent-Child Relationship mediumRelated:
\n
Unusual Service Host Child Process - Childless Service medium
\n","eir-block-03":"
Suspicious Execution from VS Code Extension mediumRelated:
\n
Remote XSL Script Execution via COM lowRelated:
\n
Process Created with a Duplicated Token mediumRelated:
\n
Privileges Elevation via Parent Process PID Spoofing highRelated:
\n
Process Created with an Elevated Token highRelated:
\n","eir-block-04":"
Execution of File Written or Modified by Microsoft Office highRelated:
\n
Execution via local SxS Shared Module mediumRelated:
\n
Execution of a Downloaded Windows Script mediumRelated:
\n
Potential System Tampering via File Modification highRelated:
\n
Suspicious File Renamed via SMB highRelated:
\n
Potential Ransomware Note File Dropped via SMB highRelated:
\n
Suspicious HTML File Creation mediumRelated:
\n
Potential Lateral Tool Transfer via SMB Share mediumRelated:
\n
Remote Execution via File Shares mediumRelated:
\n
Lateral Movement via Startup Folder highRelated:
\n
Persistence via Scheduled Job Creation mediumRelated:
\n
Persistence via Microsoft Office AddIns highRelated:
\n
Persistence via Microsoft Outlook VBA mediumRelated:
\n
Persistence via PowerShell profile mediumRelated:
\n
Startup Persistence by a Suspicious Process mediumRelated:
\n
Startup Folder Persistence via Unsigned Process mediumRelated:
\n
Persistent Scripts in the Startup Directory mediumRelated:
\n
Potential Persistence via Mandatory User Profile mediumRelated:
\n
Potential Web Shell ASPX File Creation mediumRelated:
\n
Potential privilege escalation via CVE-2022-38028 highRelated:
\n
Creation or Modification of a new GPO Scheduled Task or Service lowRelated:
\n
Suspicious Print Spooler SPL File Created lowRelated:
\n
Privilege Escalation via Rogue Named Pipe Impersonation highRelated:
\n","eir-block-05":"
Potential Windows Error Manager Masquerading mediumRelated:
\n
Network Connection via Signed Binary lowRelated:
\n
MsBuild Making Network Connections mediumRelated:
\n
Mshta Making Network Connections mediumRelated:
\n
MsiExec Service Child Process With Network Connection mediumRelated:
\n
Network Connection via MsXsl lowRelated:
\n
Unusual Network Activity from a Windows System Binary mediumRelated:
\n
Unusual Network Connection via DllHost mediumRelated:
\n
Unusual Network Connection via RunDLL32 mediumRelated:
\n
Unusual Process Network Connection lowRelated:
\n
Potential Enumeration via Active Directory Web Service mediumRelated:
\n
System Public IP Discovery via DNS Query high
\n
Suspicious Command Prompt Network Connection lowRelated:
\n
Network Connection via Compiled HTML File lowRelated:
\n
PsExec Network Connection lowRelated:
\n
Network Connection via Registration Utility low
\n
Outbound Scheduled Task Activity via PowerShell medium
\n
Suspicious File Renamed via SMB highRelated:
\n
Potential Ransomware Note File Dropped via SMB highRelated:
\n
Execution from a Removable Media with Network Connection lowRelated:
\n
Potential Remote File Execution via MSIEXEC lowRelated:
\n
Service Command Lateral Movement lowRelated:
\n
Suspicious Kerberos Authentication Ticket Request highRelated:
\n
SMB Connections via LOLBin or Untrusted Process mediumRelated:
\n
Incoming Execution via WinRM Remote Shell mediumRelated:
\n
WMI Incoming Lateral Movement medium
\n
Incoming Execution via PowerShell Remoting mediumRelated:
\n
Remotely Started Services via RPC mediumRelated:
\n
Remote Scheduled Task Creation mediumRelated:
\n","eir-block-06":"
Potential Remote File Execution via MSIEXEC lowRelated:
\n
Suspicious Execution from VS Code Extension mediumRelated:
\n
Remote XSL Script Execution via COM lowRelated:
\n
Process Created with a Duplicated Token mediumRelated:
\n
Privileges Elevation via Parent Process PID Spoofing highRelated:
\n
Process Created with an Elevated Token highRelated:
\n","eir-block-07":"
Host File System Changes via Windows Subsystem for Linux mediumRelated:
\n
Execution of File Written or Modified by Microsoft Office highRelated:
\n
Execution via local SxS Shared Module mediumRelated:
\n
Execution of a Downloaded Windows Script mediumRelated:
\n
Potential System Tampering via File Modification highRelated:
\n
Suspicious File Renamed via SMB highRelated:
\n
Potential Ransomware Note File Dropped via SMB highRelated:
\n
Suspicious HTML File Creation mediumRelated:
\n
Potential Lateral Tool Transfer via SMB Share mediumRelated:
\n
Remote Execution via File Shares mediumRelated:
\n
Lateral Movement via Startup Folder highRelated:
\n
Persistence via Scheduled Job Creation mediumRelated:
\n
Persistence via Microsoft Office AddIns highRelated:
\n
Persistence via Microsoft Outlook VBA mediumRelated:
\n
Persistence via PowerShell profile mediumRelated:
\n
Startup Persistence by a Suspicious Process mediumRelated:
\n
Startup Folder Persistence via Unsigned Process mediumRelated:
\n
Persistent Scripts in the Startup Directory mediumRelated:
\n
Potential Persistence via Mandatory User Profile mediumRelated:
\n
Potential Web Shell ASPX File Creation mediumRelated:
\n
Potential privilege escalation via CVE-2022-38028 highRelated:
\n
Creation or Modification of a new GPO Scheduled Task or Service lowRelated:
\n
Suspicious Print Spooler SPL File Created lowRelated:
\n
Privilege Escalation via Rogue Named Pipe Impersonation highRelated:
\n","eir-block-08":"
SolarWinds Process Disabling Services via Registry mediumRelated:
\n
Windows Subsystem for Linux Distribution Installed mediumRelated:
\n
NullSessionPipe Registry Modification mediumRelated:
\n
RDP Enabled via Registry mediumRelated:
\n
Potential SharpRDP Behavior highRelated:
\n
Remote Scheduled Task Creation mediumRelated:
\n
Installation of Custom Shim Databases mediumRelated:
\n
Registry Persistence via AppCert DLL mediumRelated:
\n
Registry Persistence via AppInit DLL mediumRelated:
\n
Creation of a Hidden Local User Account highRelated:
\n
Image File Execution Options Injection mediumRelated:
\n
Suspicious Startup Shell Folder Modification highRelated:
\n
Scheduled Task Created by a Windows Script mediumRelated:
\n
Netsh Helper DLL lowRelated:
\n
Uncommon Registry Persistence Change mediumRelated:
\n
Startup or Run Key Registry Modification lowRelated:
\n
Unusual Persistence via Services Registry lowRelated:
\n
Component Object Model Hijacking lowRelated:
\n
Suspicious ImagePath Service Creation highRelated:
\n
Potential Persistence via Time Provider Modification mediumRelated:
\n
Persistence via Hidden Run Key Detected highRelated:
\n
Installation of Security Support Provider mediumRelated:
\n
Persistence via WMI Standard Registry Provider highRelated:
\n
Werfault ReflectDebugger Persistence lowRelated:
\n
Disabling User Account Control via Registry Modification mediumRelated:
\n
Potential LSA Authentication Package Abuse mediumRelated:
\n
Potential Port Monitor or Print Processor Registration Abuse mediumRelated:
\n
Potential Privilege Escalation via Service ImagePath Modification mediumRelated:
\n
Privilege Escalation via Windir Environment Variable highRelated:
\n","eir-block-09":"
SolarWinds Process Disabling Services via Registry mediumRelated:
\n
Windows Subsystem for Linux Distribution Installed mediumRelated:
\n
NullSessionPipe Registry Modification mediumRelated:
\n
RDP Enabled via Registry mediumRelated:
\n
Potential SharpRDP Behavior highRelated:
\n
Remote Scheduled Task Creation mediumRelated:
\n
Installation of Custom Shim Databases mediumRelated:
\n
Registry Persistence via AppCert DLL mediumRelated:
\n
Registry Persistence via AppInit DLL mediumRelated:
\n
Creation of a Hidden Local User Account highRelated:
\n
Image File Execution Options Injection mediumRelated:
\n
Suspicious Startup Shell Folder Modification highRelated:
\n
Scheduled Task Created by a Windows Script mediumRelated:
\n
Netsh Helper DLL lowRelated:
\n
Uncommon Registry Persistence Change mediumRelated:
\n
Startup or Run Key Registry Modification lowRelated:
\n
Unusual Persistence via Services Registry lowRelated:
\n
Component Object Model Hijacking lowRelated:
\n
Suspicious ImagePath Service Creation highRelated:
\n
Potential Persistence via Time Provider Modification mediumRelated:
\n
Persistence via Hidden Run Key Detected highRelated:
\n
Installation of Security Support Provider mediumRelated:
\n
Persistence via WMI Standard Registry Provider highRelated:
\n
Werfault ReflectDebugger Persistence lowRelated:
\n
Disabling User Account Control via Registry Modification mediumRelated:
\n
Potential LSA Authentication Package Abuse mediumRelated:
\n
Potential Port Monitor or Print Processor Registration Abuse mediumRelated:
\n
Potential Privilege Escalation via Service ImagePath Modification mediumRelated:
\n
Privilege Escalation via Windir Environment Variable highRelated:
\n","eir-block-10":"
SolarWinds Process Disabling Services via Registry mediumRelated:
\n
Windows Subsystem for Linux Distribution Installed mediumRelated:
\n
NullSessionPipe Registry Modification mediumRelated:
\n
RDP Enabled via Registry mediumRelated:
\n
Potential SharpRDP Behavior highRelated:
\n
Remote Scheduled Task Creation mediumRelated:
\n
Installation of Custom Shim Databases mediumRelated:
\n
Registry Persistence via AppCert DLL mediumRelated:
\n
Registry Persistence via AppInit DLL mediumRelated:
\n
Creation of a Hidden Local User Account highRelated:
\n
Image File Execution Options Injection mediumRelated:
\n
Suspicious Startup Shell Folder Modification highRelated:
\n
Scheduled Task Created by a Windows Script mediumRelated:
\n
Netsh Helper DLL lowRelated:
\n
Uncommon Registry Persistence Change mediumRelated:
\n
Startup or Run Key Registry Modification lowRelated:
\n
Unusual Persistence via Services Registry lowRelated:
\n
Component Object Model Hijacking lowRelated:
\n
Suspicious ImagePath Service Creation highRelated:
\n
Potential Persistence via Time Provider Modification mediumRelated:
\n
Persistence via Hidden Run Key Detected highRelated:
\n
Installation of Security Support Provider mediumRelated:
\n
Persistence via WMI Standard Registry Provider highRelated:
\n
Werfault ReflectDebugger Persistence lowRelated:
\n
Disabling User Account Control via Registry Modification mediumRelated:
\n
Potential LSA Authentication Package Abuse mediumRelated:
\n
Potential Port Monitor or Print Processor Registration Abuse mediumRelated:
\n
Potential Privilege Escalation via Service ImagePath Modification mediumRelated:
\n
Privilege Escalation via Windir Environment Variable highRelated:
\n","eir-block-11":"
Host File System Changes via Windows Subsystem for Linux mediumRelated:
\n
Execution of File Written or Modified by Microsoft Office highRelated:
\n
Execution via local SxS Shared Module mediumRelated:
\n
Execution of a Downloaded Windows Script mediumRelated:
\n
Potential System Tampering via File Modification highRelated:
\n
Suspicious File Renamed via SMB highRelated:
\n
Potential Ransomware Note File Dropped via SMB highRelated:
\n
Suspicious HTML File Creation mediumRelated:
\n
Potential Lateral Tool Transfer via SMB Share mediumRelated:
\n
Remote Execution via File Shares mediumRelated:
\n
Lateral Movement via Startup Folder highRelated:
\n
Persistence via Scheduled Job Creation mediumRelated:
\n
Persistence via Microsoft Office AddIns highRelated:
\n
Persistence via Microsoft Outlook VBA mediumRelated:
\n
Persistence via PowerShell profile mediumRelated:
\n
Startup Persistence by a Suspicious Process mediumRelated:
\n
Startup Folder Persistence via Unsigned Process mediumRelated:
\n
Persistent Scripts in the Startup Directory mediumRelated:
\n
Potential Persistence via Mandatory User Profile mediumRelated:
\n
Potential Web Shell ASPX File Creation mediumRelated:
\n
Potential privilege escalation via CVE-2022-38028 highRelated:
\n
Creation or Modification of a new GPO Scheduled Task or Service lowRelated:
\n
Suspicious Print Spooler SPL File Created lowRelated:
\n
Privilege Escalation via Rogue Named Pipe Impersonation highRelated:
\n","eir-block-12":"
Host File System Changes via Windows Subsystem for Linux mediumRelated:
\n
Execution of File Written or Modified by Microsoft Office highRelated:
\n
Execution via local SxS Shared Module mediumRelated:
\n
Execution of a Downloaded Windows Script mediumRelated:
\n
Potential System Tampering via File Modification highRelated:
\n
Suspicious File Renamed via SMB highRelated:
\n
Potential Ransomware Note File Dropped via SMB highRelated:
\n
Suspicious HTML File Creation mediumRelated:
\n
Potential Lateral Tool Transfer via SMB Share mediumRelated:
\n
Remote Execution via File Shares mediumRelated:
\n
Lateral Movement via Startup Folder highRelated:
\n
Persistence via Scheduled Job Creation mediumRelated:
\n
Persistence via Microsoft Office AddIns highRelated:
\n
Persistence via Microsoft Outlook VBA mediumRelated:
\n
Persistence via PowerShell profile mediumRelated:
\n
Startup Persistence by a Suspicious Process mediumRelated:
\n
Startup Folder Persistence via Unsigned Process mediumRelated:
\n
Persistent Scripts in the Startup Directory mediumRelated:
\n
Potential Persistence via Mandatory User Profile mediumRelated:
\n
Potential Web Shell ASPX File Creation mediumRelated:
\n
Potential privilege escalation via CVE-2022-38028 highRelated:
\n
Creation or Modification of a new GPO Scheduled Task or Service lowRelated:
\n
Suspicious Print Spooler SPL File Created lowRelated:
\n
Privilege Escalation via Rogue Named Pipe Impersonation highRelated:
\n","eir-block-13":"
Host File System Changes via Windows Subsystem for Linux mediumRelated:
\n
Execution of File Written or Modified by Microsoft Office highRelated:
\n
Execution via local SxS Shared Module mediumRelated:
\n
Execution of a Downloaded Windows Script mediumRelated:
\n
Potential System Tampering via File Modification highRelated:
\n
Suspicious File Renamed via SMB highRelated:
\n
Potential Ransomware Note File Dropped via SMB highRelated:
\n
Suspicious HTML File Creation mediumRelated:
\n
Potential Lateral Tool Transfer via SMB Share mediumRelated:
\n
Remote Execution via File Shares mediumRelated:
\n
Lateral Movement via Startup Folder highRelated:
\n
Persistence via Scheduled Job Creation mediumRelated:
\n
Persistence via Microsoft Office AddIns highRelated:
\n
Persistence via Microsoft Outlook VBA mediumRelated:
\n
Persistence via PowerShell profile mediumRelated:
\n
Startup Persistence by a Suspicious Process mediumRelated:
\n
Startup Folder Persistence via Unsigned Process mediumRelated:
\n
Persistent Scripts in the Startup Directory mediumRelated:
\n
Potential Persistence via Mandatory User Profile mediumRelated:
\n
Potential Web Shell ASPX File Creation mediumRelated:
\n
Potential privilege escalation via CVE-2022-38028 highRelated:
\n
Creation or Modification of a new GPO Scheduled Task or Service lowRelated:
\n
Suspicious Print Spooler SPL File Created lowRelated:
\n
Privilege Escalation via Rogue Named Pipe Impersonation highRelated:
\n"}}