Recon Information for Export with Command Prompt

Title: Recon Information for Export with Command Prompt
Status: test
Description:Once established within a system or network, an adversary may use automated techniques for collecting internal data.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
Author: frack113
Date: 2021-07-30
modified:2022-09-13
Tags:

• -'attack.collection'
• -'attack.t1119'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_image:
    - Image|endswith:
      - '\tree.com'
      - '\WMIC.exe'
      - '\doskey.exe'
      - '\sc.exe'
    - OriginalFileName:
      - 'wmic.exe'
      - 'DOSKEY.EXE'
      - 'sc.exe'
  selection_redirect:
    ParentCommandLine|contains:
      -' > %TEMP%\'
      -' > %TMP%\'

  condition:all of selection*
Falsepositives:
  -Unknown
Level: medium