T1588.002Resource Development
Tool
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
9 Sigma rules tagged T1588.002ToolT1588.0029 general rules
- Hacktool Execution - Imphashcriticaltest
- Hacktool Execution - PE Metadatahightest
- Renamed SysInternals DebugView Executionhightest
- Suspicious Execution Of Renamed Sysinternals Tools - Registryhightest
- Usage of Renamed Sysinternals Tools - RegistrySethightest
- PUA - Sysinternals Tools Execution - Registrymediumtest
- Suspicious Keyboard Layout Loadmediumtest
- Potential Execution of Sysinternals Toolslowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Tool
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.