Collin Lairamore
@BollinmoreTrusted contributorCompletionist
2 followers37 downloads240 copies8 likes5,396 views
63 detections
Filters
Last updated
All Time
Detection languages
54
7
2
Categories
11
10
10
9
8
Platforms
36
14
10
3
1
Products / Services
8
7
7
6
5
MITRE Techniques
8
7
6
6
5
CVEs
1
IDS Classtypes
7
1
IDS Protocols
4
3
2
System File Execution Location Anomaly
Cortex XDR
Detects common Windows system binaries (e.g., svchost.exe, rundll32.exe, powershell.exe) executing from non-standard, suspicious file paths. This behavior is often indicative of adversaries attempting to masquerade malicious executables by renaming them or placing them in paths to mimic legitimate system processes.
MMC Spawning Windows Shell
Cortex XDR
Detects instances where the Microsoft Management Console (mmc.exe) launches suspicious child processes often associated with adversary activity, such as command shells, scripting engines, or system management utilities. This behavior is frequently used to proxy execution or perform unauthorized system modifications, with the exception of the standard Task Scheduler snap-in.
Process Spawns Multiple Recon Processes
Cortex XDR
Detects anomalous host reconnaissance patterns characterized by the execution of four or more distinct discovery tools (e.g., systeminfo, ipconfig, net, whoami) by a single process within a 24-hour period. This behavior is indicative of an adversary performing environment discovery following initial access or privilege escalation. This will not catch discovery commands that are run in "memory", only those that spawn an additional executable like whoami.
7-Zip Spawns Suspicious Process (LOLBin)
Cortex XDR
Detects a 7-Zip process, the CLI binaries (7z.exe/7za.exe), the GUI worker (7zG.exe), or the File Manager (7zFM.exe) spawning a command interpreter, script host, proxy-execution LOLBin, or download/staging utility as a child. This pattern indicates archive-delivered payload execution, where adversaries use encrypted or password-protected archives to evade mail and AV inspection and the payload runs when the recipient extracts it, as well as scripted CLI abuse for tool execution or exfil staging. Logic is split by parent: the CLI and worker binaries fire unqualified since they have no legitimate reason to spawn these children, while the File Manager requires a suspicious command-line marker to suppress the benign baseline of users double-clicking files inside an archive.
Cortex Policy or Rule Modification
Cortex XDR
This rule detects modifications to Cortex prevention policies or detection rules. Specifically, it looks for creation, editing, or deletion of policy profiles, and editing, reordering, or reverting of prevention policy rules. Authorized personnel can be added to the email filter and this rule can serve as a detection for unauthorized tampering.
Event Ingestion Volume Drop Anomaly
Cortex XDR
This rule detects an anomalous drop in the daily volume of events in a dataset. It calculates the average daily volume over the past 6 days (excluding the current day) as a baseline. It then flags if the current day's volume is less than 80% of this baseline, but only if the baseline itself is greater than 1000 events. This indicates a significant decrease in expected activity, which could suggest a sensor outage, tampering, or a system being taken offline unexpectedly.
MiniPlasma Registry Modification
Cortex XDR
This rule detects attempts to create or modify registry keys or values within the '.DEFAULT\Volatile Environment' path or 'Software\Policies\Microsoft\CloudFiles\BlockedApps'. Modifications to these keys can be indicator of the MiniPlasma privilege escalation technique
High Email Volume to Personal Accounts
Cortex XDR
Detects potential data exfiltration or policy violation by identifying users sending a high volume of emails, large emails, or emails to many unique personal email addresses (e.g., Gmail, Yahoo, Outlook.com) from an Office 365 Exchange Online mailbox. This rule aggregates email activity by sender and flags if any of the defined thresholds are met: total sent data to personal addresses exceeds 25 MB, total messages sent to personal addresses exceeds 10, emails sent to more than 5 unique personal addresses, or any single message sent to a personal address exceeds 25 MB. This is designed to be ran as a scheduled correlation for a day time frame. Thresholds can also be configured to fit your environment. Each user will have a different line that contains all of the matching emails they sent to, the attachments, and subjects of the emails.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
This rule detects attempts by processes other than the legitimate ThreatLocker service to open the 'policies.txt' file located in the ThreatLocker installation directory. This could indicate an attempt to tamper with or exfiltrate ThreatLocker policies.
Page 4 of 7