Custom IIOC Creation in RSA NetWitness Endpoint v4.4
Tags
attack-pattern: Data Datasets Direct Accessibility Features - T1546.008 Bash History - T1552.003 Domains - T1583.001 Domains - T1584.001 Installutil - T1218.004 Malware - T1587.001 Malware - T1588.001 Mshta - T1218.005 Powershell - T1059.001 Regsvr32 - T1218.010 Rundll32 - T1218.011 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Accessibility Features - T1015 Bash History - T1139 Installutil - T1118 Mshta - T1170 Powershell - T1086 Regsvr32 - T1117 Rundll32 - T1085 Scripting - T1064 Scripting
Show in Graph
Common Information
Type Value
UUID 2ed912fe-4e73-49db-8ea4-f92e438fece4
Fingerprint ba1f9a5e4ca101c2
Analysis status DONE
Considered CTI value 1
Text language
Published March 19, 2019, 4:58 p.m.
Added to db Jan. 18, 2023, 9:24 p.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline NetWitness Community
Title Custom IIOC Creation in RSA NetWitness Endpoint v4.4
Detected Hints/Tags/Attributes 76/1/6
Source URLs
Redirection Url
Details Source https://community.rsa.com/community/products/netwitness/blog/2019/03/19/custom-iioc-creation
URL Provider
Details Provider Source level domain
Details rsa.com community.rsa.com
Attributes
Details Type #Events CTI Value
Details Domain 19 
www.w3schools.com
Details File 1122 
svchost.exe
Details File 31 
psexesvc.exe
Details IPv4 1 
4.4.0.9
Details Threat Actor Identifier - APT 297 
APT27
Details Url 2 
https://www.w3schools.com/sql