Techniques (MITRE) - Key Detection Signals

T1566 – Phishing

• Unusual spikes in inbound mail with suspicious URLs or attachments

• Users opening links or attachments shortly before new process starts on their endpoint

• New sign‑ins from atypical locations or devices following email interaction

• High volume of messages from newly registered or look‑alike domains

T1059 – Command and Scripting Interpreter

• PowerShell, cmd, bash, or Python launched by Office, browser, or other user‑facing apps

• Interpreters running with obfuscated or base64‑encoded command lines, hidden windows, or -ExecutionPolicy Bypass

• Script processes making direct external network connections

• Interpreters spawning other tools (net utilities, archive tools, or LOLBins) shortly after start

T1055 – Process Injection

• Suspicious processes calling memory‑manipulation or injection APIs like VirtualAllocEx, WriteProcessMemory, CreateRemoteThread

• New threads starting in high‑value processes (browsers, explorer.exe, lsass.exe, EDR/AV processes) that don’t match normal behavior

• Sudden code execution inside a trusted process that wasn’t updated or restarted

• Signs of reflective DLL loading or beacon behavior inside otherwise legitimate processes

T1003 – OS Credential Dumping

• Non‑system processes accessing LSASS or other security‑related processes

• Creation of process‑memory dump files shortly before or during credential‑access alerts

• Tools or commands saving SAM, SECURITY, or related registry hives

• Unexpected access to NTDS.dit or other AD credential stores, followed by new successful logons or lateral movement

T1021 – Remote Services

• New RDP, SMB, SSH, WinRM, or VNC connections between hosts that don’t normally communicate

• Remote logons quickly followed by file transfers, service creation, or process execution on the target

• Bursts of remote logon failures followed by one or a few successes from the same source

• Privileged accounts suddenly used to access many hosts via remote services

T1078 – Valid Accounts

• Valid logons from unusual geolocation, IP ranges, devices, or times for that user

• Accounts suddenly performing high‑privileged actions they rarely do (admin changes, mass mailbox access, widespread RDP use)

• Logons that closely follow known credential‑access activity such as dumping or password‑guessing

• Identity‑provider signals like risky sign‑ins, impossible travel, or repeated MFA failures for a single account

T1110 – Brute Force

• High rate of failed authentication attempts or account lockouts across many accounts

• Many attempts against a few accounts from the same IP or small IP range

• Repeated login attempts against multiple services (VPN, webmail, SSH, RDP) from the same source

• A small number of successful logons immediately after a large burst of failures or lockouts