Managed XDR

red-team-manual_-the-c...-sheet-version-4-.docx — malware analysis report

File info

Filename
red-team-manual_-the-cheat-sheet-version-4-.docx
File type
Zip archive data, at least v2.0 to extract
File size
1.2 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
570661311db6c187a94a3b1fdeb43c2f3fd40b3c
SHA256
81b424ca9d9abe8873a1522c4c5d2fca8337ddc5cd42fbdc98d0708379ec78bd
MD5
09a81df0798088f929473171add529cc

Signatures

Initial Access

T1192 html_urls: HTML-document downloads a file

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process

Persistence

T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key

Privilege Escalation

T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1574.011 persistence_services: Modifies Services registry key
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1083 checks_recent_files: Attempt to check recently opened files through registry

Command and Control

T1102.003 references_google: Contains links to cloud services of Google (potentially for malicious payload delivery)
T1102.003 references_github: Contains links to cloud services of Github (potentially for malicious payload delivery)

Other

has_pdb: This executable file has a PDB path
creates_suspended_process: Creates suspended process
test_check_service: Starts services
office_links: Office file contains external links
pe_overlay: PE file contains overlay
yara_rules: Static rules