splunk-security_content/lookups/csv/attacker_tools.csv

1	attacker_tool_names	description
2	advanced_port_scanner.exe	Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
3	cain.exe	This process is associated with a tool used to collect user credentials and execute attacks.
4	certify.exe	A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS)
5	certipy.exe	A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS)
6	FolderContentsDeleteToFolderDelete.exe	This process is associated with code for taking advantage of filesystem-based exploit primitives.
7	FolderOrFileDeleteToSystem.exe	This process is associated with code for taking advantage of filesystem-based exploit primitives.
8	fscan.exe	Fscan is a tool used to scan for open ports and services on a network.
9	getmail.exe	This process is seen to be used by attackers to extract email files from host machines.
10	hash32.exe	This process is used to dump password hashes on a Windows system.
11	hash64.exe	This process is used to dump password hashes on a Windows system.
12	htran.exe	This process is used to dump password hashes on a Windows system.
13	isass.exe	This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
14	kidlogger.exe	This process is associated with a tool used to collect keyboard input on a host.
15	KPortScan3.exe	KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
16	mailpv.exe	This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
17	masscan.exe	This executable was delivered in the XMRig Crypto Miner
18	Massscan_GUI.exe	This executable was delivered in the XMRig Crypto Miner
19	mimikatz.exe	Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets.
20	mm32.exe	This is a process name was seen being used as a rename of mimikatz.exe.
21	mm64.exe	This is a process name was seen being used as a rename of mimikatz.exe.
22	nc.exe	This process is an open source tool used for network communications.
23	netpass.exe	This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
24	NLAChecker.exe	A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
25	NLBrute.exe	A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
26	nmap.exe	This process is an open source network mapping tool used to identify hosts and listening services on a network.
27	ns.exe	A commonly used tool used by attackers to scan and map file shares
28	ntdll.exe	This process was identified as malicious by DHS Alert TA18-074A.
29	OutlookAddressBookView.exe	This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
30	pwdump.exe	This process is associated with a tool used to dump password hashes on a Windows system.
31	pwdump2.exe	This process is associated with a tool used to dump password hashes on a Windows system.
32	quarkpwdMtCrt.exe	This process is associated with a tool used to dump password hashes on a Windows system.
33	remcom.exe	This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
34	seatbelt.exe	A tool used to collect detailed information about a system—such as remote access configurations network shares and other security-relevant data on victim machine.
35	selfdel.exe	This executable was delivered in the SamSam Ransomware Campaign and the attackers leveraged this binary to delete its malicious activities.
36	SharpGPOAbuse.exe	SharpGPOAbuse is a tool that allows you to abuse and enumerate GPOs on a Windows system.
37	SharpHide.exe	SharpHide is a tool that allows you to hide a process from the task manager.
38	SharpStay.exe	SharpStay is a tool that allows you to stay hidden from the task manager.
39	sharpTask.exe	SharpTask is a tool that allows you to create scheduled tasks on a Windows system.
40	SilverBullet.exe	Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
41	svch0st.exe	This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
42	wce.exe	This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
43	wce32.exe	This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
44	wce64.exe	This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
45	WebBrowserPassView.exe	This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.