SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Physical, insider and cross-cutting attacks

Living off the land (LOTL/LOLBins)

Native admin tools used instead of malware to evade detection

categoryPhysical, insider and cross-cutting attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Volt Typhoon

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1059 · AutoIt Script Execution · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1059 -TestGuids a9b93f17-31cb-435d-a462-5e838a2a6026 -GetPrereqs; Invoke-AtomicTest T1059 -TestGuids a9b93f17-31cb-435d-a462-5e838a2a6026 -TimeoutSeconds 120'
ATT&CK T1059 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059 -Tool atomic -RunId run-2026-11-02-003 -Command 'Invoke-AtomicTest T1059 -TestGuids a9b93f17-31cb-435d-a462-5e838a2a6026 -GetPrereqs; Invoke-AtomicTest T1059 -TestGuids a9b93f17-31cb-435d-a462-5e838a2a6026 -TimeoutSeconds 120'
ATT&CK T1059 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059 -Tool atomic -RunId run-2026-11-02-010 -Command 'Invoke-AtomicTest T1059 -TestGuids a9b93f17-31cb-435d-a462-5e838a2a6026 -GetPrereqs; Invoke-AtomicTest T1059 -TestGuids a9b93f17-31cb-435d-a462-5e838a2a6026 -TimeoutSeconds 120'

+ 22 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-11-02 · detected in 94s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1AutoIt interpreter executed a script (AutoIt3.exe running .au3/.a3x) -- T1059
Sysmon · EID 1C:\Windows\SysWOW64\calc.exe binary in a suspicious location launched by C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Sysmon · EID 1Powershell process spawned powershell instance
Sysmon · EID 11Executable file created by powershell: C:\AtomicRedTeam\ExternalPayloads\autoit-v3-setup.exe
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
… and 5 more event type(s)

Detection that fired

  • ✓ Wazuh 100464 (level 8) lab rule — AutoIt interpreter executed a script (AutoIt3.exe running .au3/.a3x) -- T1059
  • ✓ Wazuh 100465 (level 8) lab rule — AutoIt interpreter executed a script (AutoIt3.exe running .au3/.a3x) (Security 4688 arm) -- T1059

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~1920 incidental alerts/hour — tune against this.

partially detected windows · 2026-11-02

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1C:\Windows\SysWOW64\calc.exe binary in a suspicious location launched by C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Sysmon · EID 1Powershell process spawned powershell instance
Sysmon · EID 11Executable file created by powershell: C:\AtomicRedTeam\ExternalPayloads\autoit-v3-setup.exe
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
PowerShell · EID 4104Powershell script used "Invoke-command" cmdlet to execute sub script
… and 6 more event type(s)

Plus 14 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~4774 incidental alerts/hour — tune against this.

Classification

39 values: 3 lab-measured, 21 imported, 1 derived, 14 machine-classified. What do these mean?

Exploitability

Attack vectorPost-compromise / campaign
Reach (CVSS)Local
Attack complexityLow
Privileges requiredLow
User interactionNone
Attacker skill requiredMedium
Resources requiredLow
Likelihood / prevalenceHigh
MaturityEstablished

Impact & scope

SeverityHigh
ImpactConfidentialityIntegrity
PlatformContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
EnvironmentOn-premises
Target asset classEndpointServer
Kill-chain phase (tactic)ExecutionStealth
Remote supportNo

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Command ExecutionModule LoadNetwork Connection CreationProcess Creation
Defense bypassedAnti-virusApplication controlDigital certificate validation

Detection & response

Mitigated by 51

  • M1021 attack-mitigation
  • M1026 attack-mitigation
  • M1033 attack-mitigation
  • M1037 attack-mitigation
  • M1038 attack-mitigation
  • M1040 attack-mitigation
  • M1042 attack-mitigation
  • M1045 attack-mitigation
  • M1047 attack-mitigation
  • M1049 attack-mitigation
  • M1050 attack-mitigation
  • D3-APCA d3fend
  • D3-AVE d3fend
  • D3-CF d3fend
  • D3-CI d3fend
  • D3-CM d3fend
  • D3-CQ d3fend
  • D3-CSPP d3fend
  • D3-DA d3fend
  • D3-DF d3fend
  • D3-DI d3fend
  • D3-EAL d3fend
  • D3-EDL d3fend
  • D3-EFA d3fend
  • D3-FA d3fend
  • D3-FCA d3fend
  • D3-FE d3fend
  • D3-FEV d3fend
  • D3-FIM d3fend
  • D3-HBPI d3fend
  • D3-LFP d3fend
  • D3-NTCD d3fend
  • D3-NTF d3fend
  • D3-NTSA d3fend
  • D3-PHDURA d3fend
  • D3-PMAD d3fend
  • D3-PSA d3fend
  • D3-PSEP d3fend
  • D3-RC d3fend
  • D3-RD d3fend
  • … and 11 more in the database

Detected by 673

  • DET0081 attack-detection-strategy
  • DET0516 attack-detection-strategy
  • 002bdb95-0cf1-46a6-9e08-d38c128a6127 sigma
  • 00ca75ab-d5ce-43be-b86c-55ff39c6abfc sigma
  • 0152550d-3a26-4efd-9f0e-54a0b28ae2f3 sigma
  • 01c42d3c-242d-4655-85b2-34f1739632f7 sigma
  • 02030f2f-6199-49ec-b258-ea71b07e03dc sigma
  • 023394c4-29d5-46ab-92b8-6a534c6f447b sigma
  • 0250638a-2b28-4541-86fc-ea4c558fa0c6 sigma
  • 02773bed-83bf-469f-b7ff-e676e7d78bab sigma
  • 02b18447-ea83-4b1b-8805-714a8a34546a sigma
  • 03cc0c25-389f-4bf8-b48d-11878079f1ca sigma
  • 03d83090-8cba-44a0-b02f-0b756a050306 sigma
  • 04936b66-3915-43ad-a8e5-809eadfd1141 sigma
  • 04fc4b22-91a6-495a-879d-0144fec5ec03 sigma
  • 0531e43a-d77d-47c2-b89f-5fe50321c805 sigma
  • 056c7317-9a09-4bd4-9067-d051312752ea sigma
  • 058f4380-962d-40a5-afce-50207d36d7e2 sigma
  • 05c36dd6-79d6-4a9a-97da-3db20298ab2d sigma
  • 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 sigma
  • 06b401f4-107c-4ff9-947f-9ec1e7649f1e sigma
  • 076ebe48-cc05-4d8f-9d41-89245cd93a14 sigma
  • 07aa184a-870d-413d-893a-157f317f6f58 sigma
  • 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb sigma
  • 087790e3-3287-436c-bccf-cbd0184a7db1 sigma
  • 089fc3d2-71e8-4763-a8a5-c97fbb0a403e sigma
  • 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f sigma
  • 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2 sigma
  • 09576804-7a05-458e-a817-eb718ca91f54 sigma
  • 0a23a62d-c5b3-468b-a072-25064a9a8c87 sigma
  • 0a74c5a9-1b71-4475-9af2-7829d320d5c2 sigma
  • 0a99eb3e-1617-41bd-b095-13dc767f3def sigma
  • 0adfbc14-0ed1-11eb-adc1-0242ac120002 sigma
  • 0afecb6e-6223-4a82-99fb-bf5b981e92a5 sigma
  • 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a sigma
  • 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4 sigma
  • 0bbc6369-43e3-453d-9944-cae58821c173 sigma
  • 0bcfabcb-7929-47f4-93d6-b33fb67d34d1 sigma
  • 0c2f8629-7129-4a8a-9897-7e0768f13ff2 sigma
  • 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974 sigma
  • … and 633 more in the database

Tested by 145

  • 00682c9f-7df4-4df8-950b-6dcaaa3ad9af atomic
  • 007e5672-2088-4853-a562-7490ddc19447 atomic
  • 0106ffa5-fab6-4c7d-82e3-e6b8867d5e5d atomic
  • 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 atomic
  • 02428cbe-c230-4353-b31d-61c9d328b153 atomic
  • 037e9d8a-9e46-4255-8b33-2ae3b545ca6f atomic
  • 06a220b6-7e29-4bd8-9d07-5b4d86742372 atomic
  • 06d9deba-f732-48a8-af8e-bdd6e4d98c1d atomic
  • 0709945e-4fec-4c49-9faf-c3c292a74484 atomic
  • 08ffca73-9a3d-471a-aeb0-68b4aa3ab37b atomic
  • 0b44d79b-570a-4b27-a31f-3bf2156e5eaa atomic
  • 0d181431-ddf3-4826-8055-2dbf63ae848b atomic
  • 0e1483ba-8f0c-425d-b8c6-42736e058eaa atomic
  • 0f8af516-9818-4172-922b-42986ef1e81d atomic
  • 127b4afe-2346-4192-815c-69042bec570e atomic
  • 1289f78d-22d2-4590-ac76-166737e1811b atomic
  • 13c0804e-615e-43ad-b223-2dfbacd0b0b3 atomic
  • 1483fab9-4f52-4217-a9ce-daa9d7747cae atomic
  • 15756147-7470-4a83-87fb-bb5662526247 atomic
  • 161d694c-b543-4434-85c3-c3a433e33792 atomic
  • 1620de42-160a-4fe5-bbaf-d3fef0181ce9 atomic
  • 1ae5ea1f-0a4e-4e54-b2f5-4ac328a7f421 atomic
  • 1c0a870f-dc74-49cf-9afc-eccc45e58790 atomic
  • 20cb05e0-1fa5-406d-92c1-84da4ba01813 atomic
  • 22cfde89-befe-4e15-9753-47306b37a6e3 atomic
  • 2430498b-06c0-4b92-a448-8ad263c388e2 atomic
  • 275d963d-3f36-476c-8bef-a2a3960ee6eb atomic
  • 29d6f0d7-be63-4482-8827-ea77126c1ef7 atomic
  • 2a8f2d3c-3dec-4262-99dd-150cb2a4d63a atomic
  • 2d5029f0-ae20-446f-8811-e7511b58e8b6 atomic
  • 32d1cf1b-cbc2-4c09-8d05-07ec5c83a821 atomic
  • 32eb3861-30da-4993-897a-42737152f5f8 atomic
  • 331ce274-f9c9-440b-9f8c-a1006e1fce0b atomic
  • 34428cfa-8e38-41e5-aff4-9e1f8f3a7b4b atomic
  • 34e63321-9683-496b-bbc1-7566bc55e624 atomic
  • 3600d97d-81b9-4171-ab96-e4386506e2c2 atomic
  • 388a7340-dbc1-4c9d-8e59-b75ad8c6d5da atomic
  • 39ceed55-f653-48ac-bd19-aceceaf525db atomic
  • 3a53734a-9e26-4f4b-ad15-059e767f5f14 atomic
  • 3a95cdb2-c6ea-4761-b24e-02b71889b8bb atomic
  • … and 105 more in the database

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-20-010partially-detectedatomicwindows2026-10-20
run-2026-10-25-002detectedatomicwindows2026-10-25
run-2026-10-27-017detectedatomicwindows2026-10-27
run-2026-10-27-019partially-detectedatomicwindows2026-10-27
run-2026-10-27-020partially-detectedatomicwindows2026-10-27
run-2026-10-27-021partially-detectedatomicwindows2026-10-27
run-2026-10-27-022partially-detectedatomicwindows2026-10-27
run-2026-10-28-003detectedatomicwindows2026-10-28
run-2026-10-28-004detectedatomicwindows2026-10-28
run-2026-10-28-005partially-detectedatomicwindows2026-10-28
run-2026-10-28-006detectedatomicwindows2026-10-28
run-2026-10-28-009detectedatomicwindows2026-10-28
run-2026-10-28-015detectedatomicwindows2026-10-28
run-2026-10-28-016detectedatomicwindows2026-10-28
run-2026-10-28-017detectedatomicwindows2026-10-28
run-2026-10-28-018detectedatomicwindows2026-10-28
run-2026-10-28-019detectedatomicwindows2026-10-28
run-2026-11-02-010partially-detectedatomicwindows2026-11-02
run-2026-11-02-014detectedatomicwindows2026-11-02
  • run-2026-10-20-010 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1218 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1657 max_level=15 dwell_s=90
  • run-2026-10-25-002 — Firing-proof re-detonation for deployed rule 100410. Rule matches gpscript.exe image + /(logon|startup). Proving the deployed regex fires on the live manager via a real round-trip.; expected=1 incidental=1776 max_level=15 dwell_s=90
  • run-2026-10-27-017 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1140 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: certutil -encode/-decode round-trips calc.exe under %TEMP%; local-only (no URL), cleanup deletes both temp files. Defender may scan the decoded exe (a copy of a signed Microsoft binary).; expected=1 incidental=1808 max_level=15 dwell_s=90
  • run-2026-10-27-019 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1202 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: forfiles /c launches calc.exe indirectly from System32; read-only, local-only, no files written.; expected=0 incidental=1805 max_level=15 dwell_s=90
  • run-2026-10-27-020 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed-script proxy execution: cscript runs the Microsoft-signed manage-bde.wsf with COMSPEC pointed at calc.exe; env var is process-local and the cleanup resets it.; expected=0 incidental=1837 max_level=15 dwell_s=90
  • run-2026-10-27-021 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216.002 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed SyncAppvPublishingServer.vbs launches 'Start-Process calc'; no files written, nothing persistent, local-only.; expected=0 incidental=1823 max_level=15 dwell_s=90
  • run-2026-10-27-022 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1218.011 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: rundll32 url.dll,FileProtocolHandler opens calc.exe; local-only, no files written.; expected=0 incidental=1829 max_level=15 dwell_s=90
  • run-2026-10-28-003 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1218.011 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: rundll32 url.dll,FileProtocolHandler opens calc.exe; local-only, no files written.; expected=1 incidental=3442 max_level=15 dwell_s=90
  • run-2026-10-28-004 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed-script proxy execution: cscript runs the Microsoft-signed manage-bde.wsf with COMSPEC pointed at calc.exe; env var is process-local and the cleanup resets it.; expected=2 incidental=1711 max_level=15 dwell_s=90
  • run-2026-10-28-005 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216.002 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed SyncAppvPublishingServer.vbs launches 'Start-Process calc'; no files written, nothing persistent, local-only.; expected=0 incidental=1922 max_level=15 dwell_s=90
  • run-2026-10-28-006 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1202 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: forfiles /c launches calc.exe indirectly from System32; read-only, local-only, no files written.; expected=2 incidental=1799 max_level=15 dwell_s=90
  • run-2026-10-28-009 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216.002 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed SyncAppvPublishingServer.vbs launches 'Start-Process calc'; no files written, nothing persistent, local-only.; expected=2 incidental=3827 max_level=15 dwell_s=90
  • run-2026-10-28-015 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1140 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: certutil -encode/-decode round-trips calc.exe under %TEMP%; local-only (no URL), cleanup deletes both temp files. Defender may scan the decoded exe (a copy of a signed Microsoft binary).; expected=1 incidental=1716 max_level=15 dwell_s=90
  • run-2026-10-28-016 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1202 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: forfiles /c launches calc.exe indirectly from System32; read-only, local-only, no files written.; expected=2 incidental=1730 max_level=15 dwell_s=90
  • run-2026-10-28-017 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed-script proxy execution: cscript runs the Microsoft-signed manage-bde.wsf with COMSPEC pointed at calc.exe; env var is process-local and the cleanup resets it.; expected=2 incidental=1726 max_level=15 dwell_s=90
  • run-2026-10-28-018 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1216.002 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Signed SyncAppvPublishingServer.vbs launches 'Start-Process calc'; no files written, nothing persistent, local-only.; expected=2 incidental=1736 max_level=15 dwell_s=90
  • run-2026-10-28-019 — Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1218.011 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: rundll32 url.dll,FileProtocolHandler opens calc.exe; local-only, no files written.; expected=2 incidental=1711 max_level=15 dwell_s=90
  • run-2026-11-02-010 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=187 max_level=15 dwell_s=90
  • run-2026-11-02-014 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy. [renumbered from run-2026-11-02-003 on commit: the harness reused that id because the prereq-only run-2026-11-02-003 lives in lab/results-excluded/]; expected=2 incidental=72 max_level=15 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 688 of Cyber-Attack-Taxonomy.md
  • ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1218, attack:T1059 as the nearest framework entries; ids verified to exist in the cached catalogues.
  • ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 44 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-010 (partially-detected) for T1218: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-25) — Lab detonation run-2026-10-25-002 (detected): Wazuh rule(s) 100410 fired on T1218 within the detonation window
    LOLBin execution via gpscript.exe: Group Policy logon/startup script runner used to proxy-execute a configured script -- T1218
  • ev-0007 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-017 (detected): Wazuh rule(s) 92018 fired on T1140 within the detonation window
    CertUtil.exe used to decode binary file
  • ev-0008 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-019 (partially-detected) for T1202: no alert matched the expected technique
  • ev-0009 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-020 (partially-detected) for T1216: no alert matched the expected technique
  • ev-0010 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-021 (partially-detected) for T1216.002: no alert matched the expected technique
  • ev-0011 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-022 (partially-detected) for T1218.011: no alert matched the expected technique
  • ev-0012 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-003 (detected): Wazuh rule(s) 100413 fired on T1218.011 within the detonation window
    rundll32 proxy execution of a program/script via url.dll FileProtocolHandler/OpenURL, shell32 ShellExec_RunDLL, mshtml RunHTMLApplication, pcwutl LaunchApplication or javascript: (Security 4688 arm) -- T1218.011
  • ev-0013 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-004 (detected): Wazuh rule(s) 100414, 100415 fired on T1216 within the detonation window
    Signed-script proxy execution: cscript/wscript running manage-bde.wsf or pubprn.vbs (COMSPEC / script: moniker abuse) (Security 4688 arm) -- T1216
  • ev-0014 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-005 (partially-detected) for T1216.002: no alert matched the expected technique
  • ev-0015 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-006 (detected): Wazuh rule(s) 100418, 100419 fired on T1202 within the detonation window
    Indirect command execution via forfiles.exe /c launching a shell/LOLBin payload -- T1202
  • ev-0016 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-009 (detected) for T1216.002: no alert matched the expected technique
  • ev-0017 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-015 (detected): Wazuh rule(s) 92018 fired on T1140 within the detonation window
    CertUtil.exe used to decode binary file
  • ev-0018 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-016 (detected): Wazuh rule(s) 100418, 100419 fired on T1202 within the detonation window
    Indirect command execution via forfiles.exe /c launching a shell/LOLBin payload (Security 4688 arm) -- T1202
  • ev-0019 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-017 (detected): Wazuh rule(s) 100414, 100415 fired on T1216 within the detonation window
    Signed-script proxy execution: cscript/wscript running manage-bde.wsf or pubprn.vbs (COMSPEC / script: moniker abuse) (Security 4688 arm) -- T1216
  • ev-0020 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-018 (detected) for T1216.002: no alert matched the expected technique
  • ev-0021 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-019 (detected): Wazuh rule(s) 100412, 100413 fired on T1218.011 within the detonation window
    rundll32 proxy execution of a program/script via url.dll FileProtocolHandler/OpenURL, shell32 ShellExec_RunDLL, mshtml RunHTMLApplication, pcwutl LaunchApplication or javascript: -- T1218.011
  • ev-0022 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-010 (partially-detected) for T1059: no alert matched the expected technique
  • ev-0023 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-014 (detected): Wazuh rule(s) 100464, 100465 fired on T1059 within the detonation window
    AutoIt interpreter executed a script (AutoIt3.exe running .au3/.a3x) -- T1059