F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
This rule detects the execution of Remote Monitoring and Management (RMM) tools by service accounts. RMM tools are legitimate software used for IT administration, but their use by service accounts can be indicative of malicious activity, such as an adversary maintaining persistence or performing lateral movement using compromised credentials. The rule identifies processes whose filenames match a predefined list of RMM tool executables or process names and are executed by accounts identified as service accounts based on common naming patterns.
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
Detects the creation of specific VBScript or PowerShell dropper files (6202033.vbs, 6202033.ps1) within temporary directories. This activity is indicative of malware attempting to establish a foothold or execute malicious code.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
Detects Azure AD application registrations with redirect URIs pointing to known tunneling, reverse proxy, or attacker interaction/callback infrastructure. This can indicate an adversary attempting to establish persistence or exfiltrate data.
This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.
This rule detects sign-in attempts to Azure AD where the User-Agent string contains 'TruffleHog'. TruffleHog is an open-source tool used for finding sensitive data like credentials in various data sources, including code repositories. Its presence in sign-in logs could indicate an adversary or security researcher attempting to verify leaked credentials or discover exposed secrets related to Azure AD service principals.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Page 10 of 15