Enzo Bomfim
@Enzima45Completionist
2 followers29 downloads222 copies10 likes2,812 views
10 detections
Filters
Last updated
All Time
Detection languages
10
Categories
2
1
1
1
Platforms
7
1
1
1
Products / Services
1
1
MITRE Techniques
5
3
2
2
2
IDS Classtypes
1
Detects logs cleared in MacOS systems
Identity LOLBA trying to dump AD server credentials and security information´s
Query identity the deletetion of the file ConsoleHost_history.txt, the file stores the process command line history of Powershell
The query aims to detect de tool the tool called GhostLocker focusing in your modus operandi
The query aim to identify a typical ransomware behavior which is file encryption follow by file deletion
This query focuses on detecting the Brazilian banking trojan known as Maverick. This malware has recently gained attention due to its aggressive propagation methods, particularly through WhatsApp Web. By leveraging social engineering techniques, Maverick spreads malicious links and attachments disguised as legitimate messages, tricking users into executing harmful code. Once installed, the trojan is capable of intercepting banking credentials, manipulating transactions, and exfiltrating sensitive financial information. Detecting Maverick requires monitoring suspicious script executions, abnormal network traffic patterns, and unauthorized use of processes such as cscript.exe and wscript.exe, which are often abused by attackers to run malicious payloads. The query aims to identify indicators of compromise associated with Maverick’s activity, helping security teams mitigate its impact and protect users from financial fraud
Thu rule focus in identity suspicious powershell commands execuded from the the windows "EXECUTE" box (WIN+R)
Detects users who accessed Microsoft Copilot Studio and correlates that activity with OAuth consent events for third-party applications in Azure Active Directory. Optionally, it verifies whether the consented application was used to access data via Microsoft Graph API, indicating potential account compromise.
Detect the patten execution of the the brazilian malware Zapgrande
Detected endpoints that processed an SVG file and subsequently connected to a known malicious domain.