F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,749 copies132 likes25,406 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
This rule aggregates software inventory, vulnerability assessments, network connection events, and exposure graph data to prioritize patching and identify internet-facing devices running PHP with known vulnerabilities or active web listeners.
Detects the presence of known malicious or suspicious OAuth application IDs as well as specific third-party applications like SkyKick or ConnectWise within OAuth application metadata over a 30-day window.
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects sign-in events to Entra ID via service principals where the application is marked as external and enabled, and the user agent string indicates the use of a Python client.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
This rule queries the ExposureGraphNodes table to identify and summarize assets that are configured as internet-facing or exposed to the internet.
Page 1 of 15