Search results

How do I know which Sysmon events are involved in each step?Can the dataset annotate the malicious logs?

Status: Open.

#54 In OTRF/detection-hackathon-apt29;

· xiaodupi-zyq opened on Dec 17, 2020

20.B) Pass the Ticket, Windows Remote Management, Create Account

Status: Open.

#48 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

20.A) Rundll32, Windows Management Instrumentation Event Subscription, PowerShell

Status: Open.

#47 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

19.C) File Deletion, Process Injection

Status: Open.

#46 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

19.B) File Deletion, Process Injection

Status: Open.

#45 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

19.A) File Deletion, Process Injection

Status: Open.

#44 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

18.A) Web Service, Exfiltration Over Alternative Protocol

Status: Open.

#43 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

17.C) Data Compressed, Obfuscated Files or Information

Status: Open.

#42 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

17.B) Data from Local System, Data Staged

Status: Open.

#41 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

16.D) Remote File Copy, Credential Dumping

Status: Open.

#40 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

16.C) Next, the attacker uses the previously dumped credentials (T1078) to create a remote PowerShell session to the domain controller (T1028).

Status: Open.

#39 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020

16.B) System Owner/User Discovery, Execution through API

Status: Open.

#38 In OTRF/detection-hackathon-apt29;

· Cyb3rWard0g opened on May 2, 2020