From da230f6ed6e6bb05b15eea88e4e4ed421dda5d78 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 2 Aug 2022 13:31:49 +0200 Subject: [PATCH] dcrat-analytics3 --- detections/endpoint/windows_system_logoff_commandline.yml | 2 +- detections/endpoint/windows_system_reboot_commandline.yml | 2 +- detections/endpoint/windows_system_shutdown_commandline.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index f1bd6ed549..49e9cc206b 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to logoff a windows host machine. +description: The following analytic identifies Windows commandline to logoff a windows host machine. This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine. diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 55ed3995c9..59663bc318 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to reboot a windows host machine. +description: The following analytic identifies Windows commandline to reboot a windows host machine. This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine. diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 9374e4c8d5..e240068959 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to shutdown a windows host machine. +description: The following analytic identifies Windows commandline to shutdown a windows host machine. This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine.