LoFP
/
t1059.005
t1059.005
Title
Tags
administrative activity
t1003
t1016
t1021
t1021.001
t1027
t1036
t1053
t1053.005
t1059
t1059.001
t1059.005
t1071
t1071.001
t1087
t1087.001
t1087.002
t1098
t1105
t1133
t1134
t1136
t1136.001
t1137
t1222
t1222.001
t1505
t1505.004
t1552
t1552.006
t1555
t1555.004
t1562
t1562.001
t1572
t1615
windows
linux
sigma
administrative scripts
t1021
t1021.002
t1039
t1048
t1055
t1059
t1059.001
t1059.005
t1137
t1218
t1543
t1543.003
windows
sigma
legitimate administrative scripts
t1059
t1059.005
windows
sigma
microsoft sccm
t1059
t1059.001
t1059.005
t1218
windows
sigma
need tuning applocker or add exceptions in siem
t1059
t1059.001
t1059.003
t1059.005
t1059.006
t1059.007
t1204
t1204.002
windows
sigma
noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. in this case, a filter is needed.
t1059
t1059.005
t1102
endpoint
splunk
some installers might generate a similar behavior. an initial baseline is required
t1059
t1059.005
t1059.007
windows
sigma