Anvilogic low experimental other

Application Discovery - Windows [snowflake-crowdstrikefdr_process]

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation. This use case detects commands enumerating applications installed on a Windows system. Atomics T1518 Test #2

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process, '.*((\\\s+query\\\s+
| Get-ItemProperty
| gp\\\s).*\\\x5cUninstall\\\x5c\\\*)
| (wmic.*\\\s+product\\\s+get\\\s+).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...