app,note
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
nc.exe,ESCU - This process is an open source tool used for network communications.
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
at.exe,ESCU - This process is used to schedule other processes to run.  schtasks.exe should be used instead as it provides more flexibility.
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.