Detection Playbooks

Regsvr32.exe is a legitimate Windows utility designed to register and unregister COM objects and DLLs. Attackers abuse it to execute malicious scripts or DLL…

Rundll32.exe is a legitimate Windows utility designed to load and execute functions exported from DLL files. Attackers abuse it to execute malicious payloads…

Pass the Hash (PtH) is a credential-based lateral movement technique where an attacker uses a captured NTLM password hash — rather than the plaintext passwor…

Kerberoasting is a credential theft technique in which an attacker with any valid domain account requests Kerberos Ticket-Granting Service (TGS) tickets for …

Password spraying is a credential access technique where an adversary attempts a single commonly used password — or a very short list — across a large number…

LSASS Memory dumping (T1003.001) is a credential theft technique where attackers extract authentication material — including NTLM hashes, Kerberos tickets, a…

DLL Side-Loading (T1574.002) is a technique where an attacker places a malicious DLL with a specific filename into a directory that a legitimate, often signe…

Windows Service persistence (T1543.003) allows adversaries to register a malicious executable as a Windows service so it automatically launches every time th…

Registry Run Keys and Startup Folder persistence (T1547.001) is a technique where adversaries write entries to specific Windows registry keys or drop files i…

Visual Basic (VB) and its derivatives — Visual Basic for Applications (VBA) and VBScript — are scripting and programming languages that adversaries abuse to …