Mirrors/keyboardcrunch-sentinelone-attack-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries synced 2026-06-10 10:07:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

T1021.001 Scripted Lateral RDP

Browse Source
This commit is contained in:
@
2020-09-27 09:52:42 -05:00
parent 7e96efb030
commit 23e97ac3c4
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
LateralMovement.md
+5 -1
View File
@@ -17,10 +17,14 @@ Detects RDS and RemoteApp session redirections for lateral movement.
SrcProcName = "tscon.exe" AND SrcProcCmdLine ContainsCIS "/dest:" SrcProcName = "tscon.exe" AND SrcProcCmdLine ContainsCIS "/dest:"
``` ```
### T1021.001 Remote Desktop Protocol ### T1021.001 Remote Desktop Protocol
Atomics: [T1021.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md) Atomics: [T1021.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md)
Below query will catch both Atomic tests because it focuses on detecting the use of cmdkey for authenticating RDP sessions (often used for automated lateral movement).
```
TgtProcName = "cmdkey.exe" AND TgtProcCmdLine ContainsCIS "/generic:TERMSRV" AND TgtProcCmdLine ContainsCIS "/user:" AND TgtProcCmdLine ContainsCIS "/pass:"
```
### T1021.002 SMB/Windows Admin Shares ### T1021.002 SMB/Windows Admin Shares
Atomics: [T1021.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.002/T1021.002.md) Atomics: [T1021.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.002/T1021.002.md)