Anandakumar Sivanandam
@AndywkCompletionist
1 follower38 downloads198 copies2 likes1,966 views
13 detections
Filters
Last updated
All Time
Detection languages
13
Categories
2
1
1
1
1
Platforms
13
1
1
Products / Services
6
1
MITRE Techniques
2
2
2
1
1
IDS Classtypes
3
2
This query is used to identify the usage of RMM tools.
Lockbit ransomware drops 9 character alphanumeric .ico and a README.TXT file
During a ransomware attack a malicious .tmp file gets dropped and executed in program data directory.
Lolbin is used to fetch the Atera's Remote Montoring and Management (RMM) agent directly from Atera's distribution domain.
capture the activity surrounding the execution of command line arguments that add a user to default privileged Windows Security Groups.
Detects malicious software alike achieve persistence is by adding a program to the startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder allows the referenced program to be executed when a user logs in.
Delete Windows shadow copies before it begins encrypting the data on the victim host. This tactic is typically carried out with powershell, vssadmin or wmic.
Mimikatz payload has been executed on a system as one-liner likely to output to a file for collection
This query capture the activity in the event the registry key that controls RDP Restricted Mode is enabled or disabled.
This rule is to identify when the registry key (SYSTEM\CurrentControlSet\Control\SecurityProviders\ WDigest\UseLogonCredential OR SYSTEM\ControlSet00*\Control\SecurityProviders\ WDigest\UseLogonCredential) is modified signaling a possible WDigest downgrade attack, which was recently seen and attributed to the SmokedHam tool from UNC2465 and its affiliates.
Page 1 of 2