mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
21 lines
2.6 KiB
CSV
21 lines
2.6 KiB
CSV
app,note
|
|
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
|
|
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
|
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
|
nc.exe,ESCU - This process is an open source tool used for network communications.
|
|
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
|
|
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
|
|
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
|
|
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
|
|
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
|
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
|
at.exe,ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
|
|
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
|
|
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
|
|
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
|
|
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
|
|
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
|
|
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
|
|
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
|
|
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
|