F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
This rule detects unsigned executables originating from the WindowsApps directory that are making network connections to IP lookup services. This behavior can indicate a potentially malicious application attempting to identify its external IP address, possibly for command and control communication or reconnaissance. Common browsers are excluded from this detection to reduce false positives.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with the '/Create' argument. This can indicate an adversary establishing persistence or scheduling malicious activity.
This rule detects suspicious activity where an Azure CLI session, initially interactive, is followed by non-interactive access from a different IP address. This could indicate an attacker using a stolen token or session from a legitimate user's interactive login to perform automated actions. The rule specifically looks for a pivot from interactive to non-interactive access where the non-interactive access occurs after the interactive access and from a different IP address, within a 30-day lookback window.
This rule detects the presence of known malicious browser extensions, specifically Urban VPN, Urban Browser Guard, Urban Ad Blocker, and 1ClickVPN Proxy, across Chrome and Edge browsers. It identifies these extensions by searching for their unique 32-character Extension IDs within file paths or file names associated with device file events. The rule then enriches the findings with the extension's name and the browser it belongs to.
This rule detects the execution of known proxyware applications such as Infatica, Honeygain, and IPRoyal by looking for specific command-line arguments. Proxyware applications monetize unused internet bandwidth by routing traffic through the user's device, which can pose security and privacy risks.
This rule detects the creation or modification of executable files with a single-character filename followed by '.exe' (e.g., 'a.exe', 'b.exe'). This pattern is often used by adversaries to evade detection or to make malicious files less conspicuous. The rule specifically excludes 'R for Windows front-end' to reduce false positives related to legitimate software.
This rule detects applications, other than common web browsers, that are making network connections to Google Analytics domains and also contain 'microsoft' in the remote URL. This could indicate an application collecting device information or other telemetry and exfiltrating it via Google Analytics, potentially for malicious purposes or unauthorized data collection.
This rule detects instances where the calculator application (calc.exe) initiates a network connection. This behavior is highly unusual for a standard calculator application and could indicate malicious activity, such as an adversary using calc.exe as a proxy for network communication or injecting malicious code into it.
This rule detects instances where 'regedit.exe' is launched by a parent process that is not commonly associated with its execution. It specifically filters out common legitimate parent processes like 'explorer.exe', 'msiexec.exe', and 'cmd.exe', and also excludes parent processes originating from standard Windows and Program Files directories. This helps to identify suspicious or unauthorized attempts to modify the Windows Registry.
This rule identifies and summarizes the usage of various Remote Monitoring and Management (RMM) tools across an environment. It correlates process execution events (based on executable and process names) and network connection events (based on remote URLs/domains) with a predefined list of known RMM tools. The output provides a count of unique devices using each RMM tool, grouped by machine group, allowing for an overview of RMM tool prevalence and distribution.
Page 14 of 15