AN1305 Analytic 1305

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Windows-specific environmental keying behavioral chain: (1) Rapid system information discovery through multiple techniques (WMI queries, registry enumeration, network share discovery, hostname/domain checks), (2) Target validation through specific environmental artifact collection (AD domain membership, network topology, installed software versions), (3) Cryptographic operation correlation indicating payload decryption based on collected environmental values, (4) Subsequent malicious code execution following successful environmental validation, (5) Temporal clustering of discovery activities suggesting automated environmental assessment</p>

Detects: T1480.001 Environmental Keying
Part of: DET0474 Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4624, 4648`	DC0067 Logon Session Creation
WinEventLog:Sysmon	`EventCode=1`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=3, 22`	DC0082 Network Connection Creation
WinEventLog:Sysmon	`EventCode=7`	DC0016 Module Load
WinEventLog:Sysmon	`EventCode=25`	DC0035 Process Access
WinEventLog:WMI	`EventCode=5857, 5858, 5860, 5861`	DC0008 WMI Creation
WinEventLog:PowerShell	`EventCode=4103, 4104, 4105, 4106`	DC0064 Command Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`DiscoveryTimeWindow`	Time window for correlating multiple discovery activities as part of environmental assessment - adjust based on observed attack patterns and system performance (default: 300 seconds)
`CriticalDiscoveryThreshold`	Minimum number of distinct discovery techniques within time window to trigger detection - tune based on environment's normal administrative activity levels
`TargetSpecificArtifacts`	Organization-specific environmental elements that adversaries might target (domain names, network shares, specific hostnames, software versions)
`CryptographicIndicatorPatterns`	Process names, command lines, and API calls indicating potential decryption operations - customize based on observed cryptographic tool usage in environment
`LegitimateAdminAccounts`	User accounts authorized to perform extensive system discovery - maintain current list to reduce false positives from legitimate administrative activities
`BusinessHoursBaseline`	Normal business hours for risk scoring adjustment - discovery activities outside these hours receive higher risk scores
`WMIQueryComplexityThreshold`	Complexity metric for WMI queries to identify sophisticated environmental assessment versus simple system checks