Chale Maz
@BigcmazCompletionist
0 followers0 downloads38 copies0 likes372 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
1
1
1
1
1
This rule detects when two different MSI installations, both related to known VPN clients (Pulse Secure, Fortinet, Ivanti, GlobalProtect), occur on the same device within a short timeframe. This could indicate an attempt to establish redundant access, bypass security controls, or an unusual administrative activity.
This rule detects the access or creation of Microsoft Office files (docx, xlsx, pptx) that have 'password' or related keywords in their filename or folder path. It also attempts to identify if these files contain password-related content through DLP indicators, suggesting potential sensitive data exposure or staging.