MITRE ATT&CK Technique
T1027
2 queries tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Unsigned Dll Load Verified Signing State
Unsigned DLL loads, using IsSigned/SigningStatus rather than treating an empty SHA256 as unsigned (the field is documented as usually-populated, not always).
-
Hunting
Hunt Cloud Metadata Ssrf Normalized Forms
Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.