Mirrors/keyboardcrunch-sentinelone-attack-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries synced 2026-06-11 10:31:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Completed PrivEsc tactics.

Browse Source
This commit is contained in:
keyboardcrunch
2020-09-15 22:06:57 -05:00
committed by GitHub
parent 1193f4dad0
commit 289e26e94d
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries.md
+9 -1
View File
@@ -149,7 +149,7 @@ Detects the addition of process execution strings (`TgtProcCmdLine In Contains A
### T1055.012 Process Hollowing ### T1055.012 Process Hollowing
Atomics: [T1055.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.012/T1055.012.md) Atomics: [T1055.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.012/T1055.012.md)
Detect Process Hollowing using the Start-Hollow powershell script, through CommandLine or CommandScript indicators. Detect Process Hollowing using the Start-Hollow powershell script, through CommandLine and CommandScript indicators.
The `IndicatorCategory = "Injection"` has a lot of noise, but in the future a combination of `EventType = "Duplicate Process Handle" AND TgtProcRelation = "storyline_child"` joined with some `ChildProcCount` or `CrossProcCount` > 0 may help filter the noise. The `IndicatorCategory = "Injection"` has a lot of noise, but in the future a combination of `EventType = "Duplicate Process Handle" AND TgtProcRelation = "storyline_child"` joined with some `ChildProcCount` or `CrossProcCount` > 0 may help filter the noise.
@@ -198,12 +198,20 @@ Focuses on Test 2: Detection .lnk or .url files written to Startup folders. Filt
### T1546.003 Windows Management Instrumentation Event Subscription ### T1546.003 Windows Management Instrumentation Event Subscription
Atomics: [T1546.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md) Atomics: [T1546.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md)
Detect WMI Event Subs using the New-CimInstance cmdlet, through CommandLine and CommandScript indicators.
```
SrcProcCmdLine ContainsCIS "New-CimInstance -Namespace root/subscription" OR SrcProcCmdScript ContainsCIS "New-CimInstance -Namespace root/subscription"
```
### T1543.003 Windows Service ### T1543.003 Windows Service
Atomics: [T1543.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md) Atomics: [T1543.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md)
Detects creation and modification of windows services through binPath argument to sc.exe.
```
TgtProcName = "sc.exe" AND TgtProcCmdLine Contains "binPath="
```
### T1547.004 Winlogon Helper DLL ### T1547.004 Winlogon Helper DLL
Atomics: [T1547.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.004/T1547.004.md) Atomics: [T1547.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.004/T1547.004.md)