T1204
User Execution
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- AWS CloudTrail
- Docker daemon events and API
- GCP VPC Flow Logs (the log as a whole)
- Linux audit framework (auditd)
- SYSCALL:chmod SYSCALL record for chmod
- SYSCALL:creat SYSCALL record for creat
- SYSCALL:execve SYSCALL record for execve
- SYSCALL:open SYSCALL record for open
- SYSCALL:rename SYSCALL record for rename
- Other Linux sources (procfs, FIM, package logs, shell history) (the log as a whole)
- syslog / journald (auth, secure, messages, cron) (the log as a whole)
- osquery (macOS)
- macOS unified log (the log as a whole)
- Network flow records (Zeek conn, NetFlow, firewall flow) (the log as a whole)
- Windows Application event log
- 1000 App Crash
- Windows Security event log
- 4688 A new process has been created.
- Sysmon
Practice it
2 scenarios in this catalog cover T1204. We don't name them, because identifying the technique is part of what a scenario grades. Explore the Range →