F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects when the IIS worker process (w3wp.exe) spawns common system and network discovery utilities such as whoami, ipconfig, systeminfo, net, and others, which may indicate web shell activity or post-exploitation discovery.
Detects when the IIS worker process (w3wp.exe) spawns command-line utilities or script interpreters such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior often indicates web application exploitation or webshell activity.
Detects scenarios where an account experiences mail bombing activity followed closely by a suspicious Microsoft Teams chat initiation by an external user within a 2-hour window, potentially indicating a multi-stage social engineering or extortion campaign.
This rule identifies instances of screen capture events initiated by processes that have previously engaged in network communication with known Remote Management Tool (RMM) domains. By correlating network activity with suspicious endpoint events, it flags potential unauthorized screen scraping performed by tools often abused by attackers for post-compromise reconnaissance.
This rule monitors for indicators of compromise (IOCs) associated with the ShinyHunters threat actor, including specific malicious domains, IP addresses, and artifacts found in command lines or event data. It aggregates telemetry from network events, Entra ID sign-in logs, cloud application activity, email logs, process execution, and general device events to detect interaction with known malicious infrastructure or execution of threat-actor specific artifacts.
Detects the clearing of the Windows Security Event Log. This activity is a common indicator of an adversary attempting to remove evidence of their presence or actions on a compromised host.
This rule detects PowerShell processes executing with hidden window styles while performing web-based download operations from GitHub domains. It further identifies potential nested PowerShell execution, which is often used in obfuscated download-and-execute attack chains.
This rule detects interaction with specific infrastructure identified as deceptive dating applications. It monitors network communication, sign-in attempts, email interactions, and endpoint execution associated with known malicious domains (e.g., archat.us, heyhru.com, sitin.ai), specific IP addresses (38.129.138.244), and unique package identifiers (com.cavalier.nalo, com.qiga.vio). The detection logic spans across DeviceNetworkEvents, EntraIdSignInEvents, EmailUrlInfo, EmailEvents, DeviceEvents, and DeviceProcessEvents to identify exposure to these Indicators of Compromise (IOCs) across both network and endpoint layers.
This rule detects activity related to specific known fabricated news infrastructure domains and associated social media handles, which are indicative of influence operations. It monitors network connection events, email URL clicks, email communication patterns involving these domains, and process executions that reference these specific accounts or handles.
Page 2 of 15