F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,749 copies132 likes25,408 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Detects when the Windows Server Update Services (WSUS) process (wsusservice.exe) or its associated IIS worker process (w3wp.exe with 'wsuspool' in its command line) spawns cmd.exe or powershell.exe. This activity is highly suspicious as WSUS services typically do not need to execute command-line interpreters, and could indicate an attempt to exploit a vulnerability or execute arbitrary commands on the system.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Detects the creation of batch (.bat) files within the Windows Startup folder, a common persistence mechanism. The rule prioritizes detection of files matching known malicious patterns, specifically 'HealthApp-*.bat' associated with the SORVEPOTEL malware, and flags other generic batch file creations in the Startup folder for investigation.
This rule detects attempts to access non-existent AWS S3 buckets, indicated by the 'NoSuchBucket' error code in CloudTrail logs. This could signify reconnaissance activities by an attacker attempting to enumerate accessible S3 buckets or misconfigurations in applications trying to access buckets that no longer exist or have incorrect names. The rule extracts the bucket name and host from the request parameters for further investigation.
Detects modifications to the Windows Registry by 'OneDrive.exe' when the initiating process command line does not correspond to a legitimate update operation. This could indicate an attempt to establish persistence or modify OneDrive's behavior for malicious purposes, potentially by an adversary using a compromised OneDrive account or malware like CreepyDrive.
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
This detection identifies when a user executes a potentially malicious command via the Windows Run dialog (Win+R). It monitors the RunMRU registry key for commands associated with living-off-the-land binaries (LOLBins) and scripting engines like PowerShell, MSHTA, Bitsadmin, and others. Such activity is often a sign of initial access, where an attacker has tricked a user into running a payload downloader or stager command
Page 15 of 15