Skip to content

Hands On Keyboard🔗

A Hands-On-Keyboard attack is when a threat actor is manually performing activities on exploited hosts rather than using scripted commands. While this type of constantly evolving threat activity can be inherently difficult to detect with signatures, the confluence of this behavior over finite time windows does lend itself to high-confidence probabilistic detection using machine learning.

This detector scores process events for a set timeframe using machine learning models and then uses these scores to identify potential Hands-On-Keyboard activity, published as alerts to the Secureworks® Taegis™ XDR Dashboard.

Hands On Keyboard Alert

Information found in high and critical alerts includes:

  • Number of events in the detection timeframe that matched features on the machine learning model
  • Common parent image path for the events in the detection timeframe

Requirements🔗

This detector requires the following data sources, integrations, or schemas:

Inputs🔗

Detections are from the following normalized sources:

Process

Outputs🔗

Alerts from this detector are pushed to the XDR Alert Database and Alert Triage Dashboard.

Configuration Options🔗

This detector is enabled by default when the required data sources or integrations are available in the tenant.

MITRE ATT&CK Category🔗

  • MITRE Enterprise ATT&CK - Execution - Command and Scripting Interpreter. For more information, see MITRE Technique T1059.

Detector Testing🔗

This detector does not have a supported testing method, though an Advanced Search will verify if alerts originated with this detector.

Note

If no supported testing method is available, an Advanced Search will show you if any alerts came from this detector if a qualifying event was observed. A search with no results does not indicate the detector is not working. A lack of search results for the detector may only indicate that the specific attack has not been observed in the tenant. However, it could indicate the underlying data is not available. Ensure the required schemas are provided in Data Sources along with the supported device type(s) for that schema.

FROM alert WHERE metadata.creator.detector.detector_id='app:detect:hands-on-keyboard'

References🔗