Paliscade can help you leverage the ATT&CK Navigator to gain better understanding on threats and focus on key areas you need better coverage with.
Click on the above tabs to preview some of the attacker's TTPs we use for detection.
Detecting Windows active scanning activities involves monitoring for patterns and behaviors indicative of network or host scanning activities commonly performed by attackers to identify vulnerable systems or services.
This can include high-frequency connection attempts, scanning of multiple ports or IP addresses, or unusual traffic patterns.
Microsoft Defender for Endpoint detection query to identify the execution of command and scripting interpreters involves searching for specific events related to command-line interfaces and scripting interpreters like Command Prompt (cmd.exe), PowerShell (powershell.exe), and others.
Detecting Windows access token manipulation involves monitoring for suspicious activities that may indicate an attacker is attempting to elevate privileges or impersonate a user by manipulating access tokens.
This can include events such as token theft, token impersonation, or modifications to token privileges.
By looking for execution of specific commands, we can see when a malicious user was on which systems, to get an idea of the type of reconnaissance they are performing for system service discovery.
We use a structure-based approach with the Sigma format to custom develop our rules before testing them and bringing to production.
