MITRE ATT&CK realignment sprint

This commit is contained in:
Wietze
2021-11-05 18:58:26 +00:00
committed by GitHub
parent 97f5042a58
commit 4f7ec8d2af
159 changed files with 190 additions and 506 deletions

View File

@@ -10,7 +10,6 @@ Commands:
Category: Execute
Privileges: User
MitreID: T1202
MitreLink: https://attack.mitre.org/techniques/T1202
OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
- Command: procdump.exe -md calc.dll foobar
Description: Loads calc.dll where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary.
@@ -18,12 +17,14 @@ Commands:
Category: Execute
Privileges: User
MitreID: T1202
MitreLink: https://attack.mitre.org/techniques/T1202
OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
Detection:
Detection:
- IOC: Process creation with given '-md' parameter
- IOC: Anomalous child processes of procdump
- IOC: Unsigned DLL load via procdump.exe or procdump64.exe
Resources:
- Link: https://twitter.com/ajpc500/status/1448588362382778372?s=20
Acknowledgement:
- Name: Alfie Champion
Handle: '@ajpc500'
---