Sunturai
Back to results
MediumSplunk security contentBhavin Patel +3

Attacker Tools On Endpoint

The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration.…

Description

The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names. This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.

Detection logic

Detection requirements

Platform
ContainersESXiLinuxmacOSPREWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
cisco_network_visibility_module_flow_datacrowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Some administrator activity can be potentially triggered, please add those users to the filter macro.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice