Skip to content

<<< Hide Navigation Hide TOC >>>

Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f)

Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.

Galaxy ColorsMITRE D3FE...Attack Pat...
Rows: 55
Loading extensions...
Collapse filters
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.2

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Cluster A Galaxy A Cluster B Galaxy B Level
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Netsh Helper DLL - T1546.007 (f63fe421-b1d1-45c0-b8a7-02cd16ff2bed) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND XSL Script Processing - T1220 (ebbe170d-aa74-4946-8511-9921243415a3) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND System Time Discovery - T1124 (f3c544dc-673c-4ef3-accb-53229f1ae077) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Control Panel - T1218.002 (4ff5d6a8-c062-4c68-a778-36fc5edd564f) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Security Account Manager - T1003.002 (1644e709-12d2-41e5-a60f-3470991f5011) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Asynchronous Procedure Call - T1055.004 (7c0f17c9-1af6-4628-9cbd-9e45482dd605) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Transport Agent - T1505.002 (35187df2-31ed-43b6-a1f5-2f1d3d58d3f1) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND AppCert DLLs - T1546.009 (7d57b371-10c2-45e5-b3cc-83a8fb380e4c) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Compiled HTML File - T1218.001 (a6937325-9321-4e2e-bb2b-3ed2d40b2a9d) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND LSASS Memory - T1003.001 (65f2d882-3f41-4d48-8a06-29af77ec9f90) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Application Window Discovery - T1010 (4ae4f953-fe58-4cc8-a327-33257e30a830) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND LSA Secrets - T1003.004 (1ecfdab8-7d59-4c98-95d4-dc41970f57fc) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Web Shell - T1505.003 (5d0d3609-d06d-49e1-b9c9-b544e0c618cb) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND SQL Stored Procedures - T1505.001 (f9e9365a-9ca2-4d9c-8e7c-050d73d1101a) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Process Doppelgänging - T1055.013 (7007935a-a8a7-4c0b-bd98-4e85be8ed197) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND CMSTP - T1218.003 (4cbc6a62-9e34-4f94-8a19-5c1a11392a49) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND AppInit DLLs - T1546.010 (cc89ecbd-3d33-4a41-bcca-001e702d18fd) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Mshta - T1218.005 (840a987a-99bd-4a80-a5c9-0cb2baa6cade) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Parent PID Spoofing - T1134.004 (93591901-3172-4e94-abf8-6034ab26f44a) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Exploitation for Credential Access - T1212 (9c306d8d-cde7-4b4c-b6e8-d0bb16caca36) Attack Pattern 1
Process Spawn Analysis (b1cfe58d-38df-5fcd-bb68-b832d15a395f) MITRE D3FEND Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) Attack Pattern 1
Netsh Helper DLL - T1546.007 (f63fe421-b1d1-45c0-b8a7-02cd16ff2bed) Attack Pattern Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern 2
Control Panel - T1218.002 (4ff5d6a8-c062-4c68-a778-36fc5edd564f) Attack Pattern System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern 2
Security Account Manager - T1003.002 (1644e709-12d2-41e5-a60f-3470991f5011) Attack Pattern OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) Attack Pattern 2
Asynchronous Procedure Call - T1055.004 (7c0f17c9-1af6-4628-9cbd-9e45482dd605) Attack Pattern Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) Attack Pattern 2
Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern 2
Transport Agent - T1505.002 (35187df2-31ed-43b6-a1f5-2f1d3d58d3f1) Attack Pattern Server Software Component - T1505 (d456de47-a16f-4e46-8980-e67478a12dcb) Attack Pattern 2
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern AppCert DLLs - T1546.009 (7d57b371-10c2-45e5-b3cc-83a8fb380e4c) Attack Pattern 2
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Compiled HTML File - T1218.001 (a6937325-9321-4e2e-bb2b-3ed2d40b2a9d) Attack Pattern 2
LSASS Memory - T1003.001 (65f2d882-3f41-4d48-8a06-29af77ec9f90) Attack Pattern OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) Attack Pattern 2
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) Attack Pattern 2
LSA Secrets - T1003.004 (1ecfdab8-7d59-4c98-95d4-dc41970f57fc) Attack Pattern OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) Attack Pattern 2
Server Software Component - T1505 (d456de47-a16f-4e46-8980-e67478a12dcb) Attack Pattern Web Shell - T1505.003 (5d0d3609-d06d-49e1-b9c9-b544e0c618cb) Attack Pattern 2
Server Software Component - T1505 (d456de47-a16f-4e46-8980-e67478a12dcb) Attack Pattern SQL Stored Procedures - T1505.001 (f9e9365a-9ca2-4d9c-8e7c-050d73d1101a) Attack Pattern 2
Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b) Attack Pattern Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) Attack Pattern 2
Process Doppelgänging - T1055.013 (7007935a-a8a7-4c0b-bd98-4e85be8ed197) Attack Pattern Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) Attack Pattern 2
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 2
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern CMSTP - T1218.003 (4cbc6a62-9e34-4f94-8a19-5c1a11392a49) Attack Pattern 2
AppInit DLLs - T1546.010 (cc89ecbd-3d33-4a41-bcca-001e702d18fd) Attack Pattern Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern 2
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Mshta - T1218.005 (840a987a-99bd-4a80-a5c9-0cb2baa6cade) Attack Pattern 2
Parent PID Spoofing - T1134.004 (93591901-3172-4e94-abf8-6034ab26f44a) Attack Pattern Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) Attack Pattern 2