Another snapattack windows batch - #4192
Open
RavenTait wants to merge 2 commits into
Open
Conversation
RavenTait
requested review from
P4T12ICK,
ljstella,
nasbench,
patel-bhavin,
pyth0n1c,
rosplk and
tccontre
as code owners
July 30, 2026 15:24
There was a problem hiding this comment.
Pull request overview
This pull request adds new Windows endpoint detections converted from Snap Attack and expands the attacker tooling lookup to improve coverage for common discovery and execution behaviors.
Changes:
- Added 4 new endpoint detection analytics for Windows process and PowerShell behaviors.
- Updated the
attacker_toolslookup to includenetscan.exe.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| lookups/csv/attacker_tools.csv | Adds netscan.exe to the attacker tools lookup to improve enrichment/triage. |
| detections/endpoint/windows_suspicious_child_of_consent_exe.yml | New analytic for unexpected child processes spawned by consent.exe (UAC bypass signal). |
| detections/endpoint/windows_powershell_commands_from_dns_txt.yml | New analytic for PowerShell script-block patterns indicative of DNS TXT–based command retrieval/execution. |
| detections/endpoint/windows_network_sniffing_tools.yml | New analytic for executions of common Windows packet capture/sniffing utilities. |
| detections/endpoint/windows_dir_piped_to_findstr_activity.yml | New analytic for dir piped to findstr reconnaissance activity. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| description: The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications. While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network. If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment. | ||
| data_source: | ||
| - Sysmon EventID 1 | ||
| search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("wireshark.exe", "winpcap.exe", "tcpdump", "windump.exe", "netmon.exe", "netcap.exe", "dumpcap.exe", "tshark") by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory Processes.process_path Processes.process_integrity_level Processes.original_file_name Processes.parent_process Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_network_sniffing_tools_filter`' |
Comment on lines
+10
to
+11
| data_source: | ||
| - Sysmon EventID 1 |
Comment on lines
+10
to
+15
| The following analytic detects execution of powershell commands retrieved from | ||
| a remote DNS TXT query response. The use of the DNS TXT record for C2 is an uncommon | ||
| method for malware that is resilient due to the need for DNS in normal networking | ||
| activities. This can ensure that their c2 is not blocked by any firewalls. False | ||
| positives are highly unlikely due to the very uncommon chaining of powershell | ||
| and DNS TXT queries. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
This PR adds multiple new detections converted from Snap Attack. Below is a detailed summary of the changes introduced by the review.
New Analytics [4]
Multiple analytics (a total of 4) have been added in this PR covering several techniques.
Updated Lookups [1]
Netscan added to attacker_tools lookup