t1482 | LoFP

t1482

Title	Tags
administrators may use nltest for troubleshooting purposes, otherwise, rarely used.	t1482 endpoint splunk
domain administrators may use this command-line utility for legitimate information gathering purposes, but it is not common for environments with windows server 2012 and newer.	t1018 t1482 windows elastic
false positives may be present. tune as needed.	t1059.001 t1069 t1069.001 t1482 endpoint splunk
false positives should be limited as the analytic is specific to a filename with extension .zip. filter as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as the arguments used are specific to sharphound. filter as needed or add more command-line arguments as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as the command-line arguments are specific to soaphound. filter as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as the destination port is specific to active directory web services protocol, however we recommend utilizing this analytic to hunt for non-standard processes querying the adws port. filter by app or dest_ip to ad servers and remove known proceses querying adws.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 network splunk
false positives should be limited as this is specific to a file attribute not used by anything else. filter as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
it is possible certain system management frameworks utilize this command to gather trust information.	t1482 endpoint splunk
legitimate admin activity	t1003 t1003.003 t1018 t1069 t1069.002 t1087 t1087.002 t1482 t1562 t1562.004 windows linux sigma
legitimate administration activity	t1016 t1018 t1040 t1090 t1482 t1562 t1562.004 windows sigma
legitimate administration use but user and host must be investigated	t1016 t1482 windows sigma
legitimate powershell scripts that make use of these functions.	t1039 t1055 t1059 t1069 t1087 t1106 t1135 t1482 windows elastic
legitimate use of the utilities by legitimate user for legitimate reason	t1482 windows sigma
likely	t1006 t1059 t1059.001 t1082 t1091 t1200 t1217 t1482 t1560 t1560.001 t1562 windows linux sigma
limited false positives as this requires an active administrator or adversary to bring in, import, and execute.	t1482 endpoint splunk
limited false positives. if there is a true false positive, filter based on command-line or parent process.	t1482 endpoint splunk
other programs that use these command line option and accepts an 'all' parameter	t1059 t1059.001 t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 windows sigma
some false positives may arise in some environment and this may require some tuning. add additional filters or reduce level depending on the level of noise	t1059 t1059.001 t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 windows sigma