F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
KQL Query from file: Office app spawns a LOLBin
Detects the creation or modification of scheduled tasks using 'schtasks.exe' where the task is configured to run under 'NT AUTHORITY\SYSTEM' or 'NT AUTHORITY\NETWORK SERVICE' (represented as 'SYSTEM' or 'NT AUT' in the command line), but the initiating process is not a standard system process. This can indicate an attempt to establish persistence or elevate privileges.
Detects attempts to aggressively hijack file associations by modifying the Windows Registry using 'reg.exe' or 'cmd.exe'. Specifically looks for command-line arguments indicating deletion of 'UserChoice' registry keys (which define default applications for file types) and addition of 'ApplicationAssociationToasts' keys (which can suppress notifications related to file association changes). This behavior is indicative of an attacker trying to silently change default applications to maintain persistence or execute malicious code.
This rule detects network connections to known pastebin and text storage sites initiated by processes that are not common web browsers. This could indicate data exfiltration, staging of malicious code, or command and control activity where sensitive information is uploaded or retrieved by non-standard applications.
This rule detects the execution of 'CheckNetIsolation.exe' with the command-line arguments 'LoopbackExempt' and 'aad'. This specific command is used to exempt Universal Windows Platform (UWP) or Store apps from network loopback restrictions, often in the context of Azure Active Directory (AAD) authentication. While this can be a legitimate operation for development or specific application configurations, it can also be abused by malicious applications to bypass network isolation.
This rule detects attempts to hijack file associations by monitoring command-line executions of 'cmd.exe' or 'reg.exe' that involve deleting 'UserChoice' registry keys or adding 'ApplicationAssociationToasts'. This behavior is indicative of an adversary attempting to modify default program associations to achieve persistence or execute malicious code.
Detects attempts to modify the Boot Configuration Data (BCD) using bcdedit.exe. This rule specifically looks for commands that delete boot entries or values, enable safe boot with networking, disable recovery, or ignore boot status policy failures. Such modifications can be used by adversaries to establish persistence, evade defenses, or disrupt system recovery.
This rule detects suspicious enumeration of Azure Blob, File, Table, Queue, or DFS storage accounts by internal users. It identifies devices making network connections to public Azure storage URLs using potentially suspicious processes (e.g., PowerShell, Python, AzCopy, curl, wget, WinSCP, FileZilla, Storage Explorer). The rule then analyzes the distinct storage accounts accessed and uses a Jaccard index to identify unusual naming conventions among the accessed storage accounts, potentially indicating an insider attempting to discover or exfiltrate data from unfamiliar storage resources.
This rule detects sign-in attempts to Azure Active Directory (AAD) service principals where the User-Agent string contains "TruffleHog". TruffleHog is an open-source tool used for finding sensitive data (like credentials) in various data sources. Its presence in AAD sign-in logs, especially for service principals, could indicate an attempt to scan for or verify leaked secrets or credentials associated with service accounts.
This rule identifies the use of specific malicious code signing certificates by matching their SHA1 thumbprints against a predefined list. These certificates are known to be associated with various threat actors or malicious software, indicating potential supply chain compromise or the use of signed malware.
Page 13 of 15