These phases are noisy because attackers use the same tools as administrators. The library has 52 discovery rules, 27 collection rules, 13 exfiltration rules and a scattering of command-and-control detections. Their value is sequence and volume, not any single event: one net user is nothing, but ten discovery commands in two minutes from a script host is a story.
1. Discovery on Windows
users and sessions
logged-in user enumeration via the command line (two rules)
logged-on users via query.exe and via quser.exe
user and group enumeration via command-line tools
Discovery hunt: Potential enumeration of administrator groups behavior
enumeration using net.exe / net1.exe
domain and directory
Discovery hunt: command-line tool used to inventory Active Directorys
built-in nltest.exe used for domain information
Discovery hunt: Directory collection initiated with SharpHound
Discovery hunt: Exchange group collection with ADFind
permission-group discovery via ldapsearch (low)
password policy discovery, Discovery hunt: Password complexity inventory
network
network configuration collected, interface enumeration with netsh
Discovery hunt: Potential ping sweep behavior (medium), ARP reconnaissance (two rules)
SMB enumeration, network share discovery (low)
Discovery hunt: netsh-driven host firewall profile discovery behavior
Discovery hunt: Network-probing utility started, networking security tools installed
DNS reconnaissance via DNSRecon (medium)
host
WMIC enumerating running processes, services, and AV or firewall products
enumeration of running processes via the command line
hardware information gathering, Discovery hunt: Inventory checks for Document
VirtualBox and VMware enumeration (sandbox checks)
Discovery hunt: Container inventory
a generic "Discovery hunt: inventory command launches"
Discovery hunt: inventory of Windows services from public IP addresses
Oracle enumeration via tnscmd10g and Oscanner (low)
Why attackers do it: they need to know who is logged in, which accounts are privileged, which machines are reachable and whether they are inside a sandbox. Virtual-machine enumeration (VirtualBox, VMware) is a hint that the malware is deciding whether to run at all.
Using the rules. Almost all of these are informational, so they work best as inputs to a risk score. The strongest signals are (a) who ran them, such as a script host or an Office child, and (b) how many different kinds ran in a short window. SharpHound and ADFind rules are more specific because those tools have almost no legitimate role on a workstation.
2. Collection
archives
Rar.exe, 7z.exe and Wzzip.exe with password-protection parameters (three rules)
Data-collection hunt: Password-protected ZIP staging
Data-collection hunt: tar-driven compressed archive created behavior
Data-collection hunt: Scripting engine creates a compressed file under a unusual folder (two rules)
Data-transfer hunt: RAR packaging initiated through command-line switches (exfiltration group)
reading data
a scripting engine reads document files from the local system
an unsigned process reads document files from the local system
Data-collection hunt: Mail-store reads initiated by a script
LOLBAS access to a database service (two rules)
media
screen capture via a command-line tool
built-in SoundRecorder capturing audio (low, two rules)
staging
PowerShell run from a temporary directory
Data-collection hunt: Script host launched from temporary storage
Data-collection hunt: Base64 transformation in execution or data handling
Data-collection hunt: sc used to inventory Service, PowerShell and WMIC (three rules)
PowerShell running with known Mimikatz arguments
the Data-collection hunt: Hosts-file modification
A password on an archive's command line is a strong sign of intent to hide the contents from inspection. Document and Outlook reads by a script engine are even clearer, since normal users do not read mail archives with scripts.
3. Exfiltration
dns
Data-transfer hunt: DNS-port communication from an unsigned program
Data-transfer hunt: DNS-port communication from a script host
Data-transfer hunt: Third-party public DNS resolver queried directly
DNS resolution to a vendor sinkhole (a known-bad domain was queried)
http and file transfer
Data-transfer hunt: External downloads initiated with wget
a command-line file transfer / copy utility
Data-transfer hunt: BITS transfer jobs carrying outbound data HIGH
WebDAV connection to the internet
Data-transfer hunt: Office documents accessed by FTP or SSH clients low
p2p and oddities
BitTorrent file sharing
Data-transfer hunt: Network traffic attributed to Notepad low
Data-transfer hunt: Remote connections from a known-abused AutoIT script low
DNS is the favourite covert channel because most networks allow it from anywhere. A notepad process making a network connection is a textbook sign of process injection: the attacker's code is running inside notepad.exe.
4. Command and control
netcat making or accepting connections HIGH
dnscat2 DNS tunnelling HIGH
gost tunnelling tool medium
a possible connection to a TOR relay medium
reverse shells (PowerShell and scripting engines, see post 1)
Perl or Python scripts connecting to the network
a non-browser process downloading from GitHub
fontdrvhost.exe, dllhost.exe, and other normally silent system processes making connections
wscript / cscript / compiled help files connecting to external networks
PowerShell connecting to the internet
The signal in each case is a program that should not touch the network doing so. System processes such as the font driver host are expected to be network-silent, so an outbound connection often means a hollowed process.
5. A pairing rule that catches a story
discovery: group enumeration + ARP reconnaissance
collection: document files read by a script engine
staging: password-protected archive created
exfil: unusual DNS or bits upload
=> open an investigation regardless of any single alert's severity
6. Operating advice
- Do not page on single discovery events. Feed them into a scoring or hunting data set.
- Baseline DNS per host class (servers, workstations); alert on deviations.
- Block outbound DNS except to your resolver.
- Treat password-protected archives created by scripts as high priority.
- Check the writer: a legitimate backup tool and an Office child produce the same archive but mean very different things.
Deep dive A: how DNS exfiltration works
DNS carries only short labels, so data is cut into pieces and encoded into host names. An attacker's tool queries names such as <encoded chunk>.<attacker-domain>; the attacker's authoritative server receives each query and reads the chunk. Responses (often TXT records) carry commands back, which is how DNS tunnelling tools double as command and control.
very long or high-entropy sub-domain labels
thousands of unique sub-domains under one registered domain
a single host making far more queries than its peers
TXT or other rarely used record types in large volumes
queries sent straight to a public resolver, bypassing the corporate one
a program that is not a resolver using the DNS port (the unsigned-process and script-engine rules)
The endpoint rules catch the sender (an unsigned process or a script host talking on the DNS port, or direct use of a free public resolver). The resolver logs catch the pattern. Together they are far stronger than either alone.
Deep dive B: archives as staging
Attackers collect files in one folder, archive them, and upload the archive. Password protection stops inspection, and splitting into several archives gets past upload-size limits. Rules for rar, 7-zip and Winzip with a password parameter, encrypted zip creation, tar archives and script-created archives all describe the staging step. A staging archive usually appears in a user profile or a shared data folder and is often deleted after upload, so alert on creation, not on what remains.
Deep dive C: reading a discovery burst
Different tools leave different fingerprints.
net / net1 / nltest / query a short run of built-in commands, usually typed by hand
WMIC process and service lists scripted reconnaissance, often from a script host
SharpHound / ADFind a large amount of LDAP and SMB traffic to many hosts in minutes
ping sweep / ARP / port scan many connections to many addresses on one subnet
sandbox checks (VMware, VirtualBox) malware deciding whether it is being analysed
Count them. Five or more different discovery behaviours in ten minutes, from a process that is not an administration tool, should open a case. The same five spread over a day from an admin workstation probably should not.
Deep dive D: building a baseline
group hosts: servers, workstations, admin workstations, build servers
for each group measure, over 30 days, how many discovery commands per host per day
alert on a host above the 99th percentile for its group, or on any host starting a new type of command
revisit the baseline each quarter
This turns dozens of informational rules into one meaningful risk signal, without a long exclusion list.
Deep dive E: command and control, the network side
Endpoint rules see the process; the network sees the rhythm. Beacons connect periodically with a little random jitter, use unusual user agents, and often talk to freshly registered domains. Complement the endpoint rules with proxy logs (block uncategorised and newly registered domains), DNS logging, and deny-by-default egress for servers.
endpoint a normally silent process (font host, notepad) opens a connection
dns the same host resolves a rare domain at regular intervals
proxy requests with a fixed path and odd user agent
firewall a server connecting outbound where it never did before
Response playbook
isolate the host from the network
capture memory and the staging folder before cleaning
block the destination domain and address organisation-wide
reset credentials used on the host
search the fleet for the same archive names, domains and command lines