Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Detects Windows Explorer (explorer.exe) initiating outbound network connections over port 445 (SMB) to non-private, external IP addresses. This behavior aligns with the zero-click authentication coercion vulnerability (CVE-2026-32202) where Explorer automatically reaches out to a remote UNC path to fetch an icon resource, leaking NTLM hashes.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Detects Windows Explorer (explorer.exe) initiating outbound network connections over port 445 (SMB) to non-private, external IP addresses. This behavior aligns with the zero-click authentication coercion vulnerability (CVE-2026-32202) where Explorer automatically reaches out to a remote UNC path to fetch an icon resource, leaking NTLM hashes.
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
Checks for IOCs mentioned in this article. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Checks for IOCs mentioned in this article. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a
Page 9 of 13