Threat report

www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques

https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Published on: www.microsoft.com

ATT&CK techniques those detections carry

T1047Windows Management Instrumentation
T1021.002SMB/Windows Admin Shares
T1021.003Distributed Component Object Model
T1036.005Match Legitimate Resource Name or Location
T1543.003Windows Service
T1036Masquerading
T1049System Network Connections Discovery
T1090.001Internal Proxy
+7 more

Open the original

20 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Windows WMI Process Call Create	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Windows Proxy Via Registry	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
Windows Proxy Via Netsh	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
Remote WMI Command Attempt	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Ntdsutil Export NTDS	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Malicious PowerShell Process - Encoded Command	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Impacket Lateral Movement WMIExec Commandline Parameters	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Dump LSASS via comsvcs DLL	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Windows Suspicious Process File Path	Medium	Splunk security content	Sep 5, 2026	Apache License 2.0
Windows Process Execution in Temp Dir	Informational	Splunk security content	Sep 5, 2026	Apache License 2.0
Network Connection Discovery With Arp	Medium	Splunk security content	Sep 4, 2026	Apache License 2.0
Windows Process Execution From ProgramData	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Cmdline Tool Execution From Non-Shell Process	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Suspicious Copy on System32	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Network Connection Discovery With Netstat	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Malicious PowerShell Process - Execution Policy Bypass	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Impacket Lateral Movement smbexec CommandLine Parameters	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Impacket Lateral Movement Commandline Parameters	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Executables Or Script Creation In Temp Path	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Executables Or Script Creation In Suspicious Path	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 20 of 20

Filter in the catalogue