Detecting adversary tools
In this section, we will move further up the Pyramid of Pain to focus on detecting an adversary’s behavior. The exercise will look at multiple tools that are used by an adversary to perform remote execution. Rather than detecting the tool directly, we instead detect the behaviors performed by the tool or performed by the adversary by using the tool. Since the behaviors align with a technique used to achieve the adversary’s tactical objective, these types of detections can be more difficult for the adversary to evade.
Example scenario – PsExec usage
PsExec is a legitimate remote execution tool developed by Sysinternals, a Microsoft subsidiary. It is part of a collection of tools called PsTools. PsExec offers a lightweight means for authenticated users to execute commands on systems remotely. This functionality is extremely valuable for system administrators but is often abused by threat actors to advance malicious objectives. Using...