T1587.001 Malware — Detection Rules

Source-backed rule directory

• ProxyLogon MSExchange OabVirtualDirectory · test · critical · {"product":"windows","service":"msexchange-management"}
• Uncommon File Created In Office Startup Folder · test · high · {"product":"windows","category":"file_event"}
• VHD Image Download Via Browser · test · medium · {"category":"file_event","product":"windows"}
• PUA - CsExec Execution · test · high · {"category":"process_creation","product":"windows"}
• PsExec/PAExec Escalation to LOCAL SYSTEM · test · high · {"category":"process_creation","product":"windows"}
• Potential PsExec Remote Execution · test · high · {"category":"process_creation","product":"windows"}
• Potential Privilege Escalation To LOCAL SYSTEM · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0872 Detection of Malware

AN2004 Analytic 2004

Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities. Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time. Monitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.