FIN7

[tccontre]

FIN7 Detections

• Jscript Execution Using Cscript App (passed)
• Office Application Drop Executable (passed)
• XSL Script Execution With WMIC (passed)
• Non Chrome Process Accessing Chrome Default Dir (passed)
• Non Firefox Process Access Firefox Profile Dir (passed)
• Check Elevated CMD using whoami (passed)
• Cmdline Tool Not Executed In CMD Shell (passed)
• MS Scripting Process Loading WMI Module (passed)
• MS Scripting Process Loading ldap Module (passed)

Analytic Story

fin7.yml

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

XSL Script Execution With WMIC ✅

• diskUsage: 593920
• runDuration: 2.85s
• scanCount: 4

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Office Application Drop Executable ✅

• diskUsage: 180224
• runDuration: 1.283s
• scanCount: 195

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Jscript Execution Using Cscript App ✅

• diskUsage: 507904
• runDuration: 17.709s
• scanCount: 27859

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Non Firefox Process Access Firefox Profile Dir ✅

• diskUsage: 200704
• runDuration: 1.499s
• scanCount: 121

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Non Chrome Process Accessing Chrome Default Dir ✅

• diskUsage: 200704
• runDuration: 1.1360000000000001s
• scanCount: 41