F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
KQL Query
Detects instances where Windows Filtering Platform (WFP) has blocked outbound network connections initiated by critical Microsoft Defender components (e.g., MsSense.exe, MsMpEng.exe). Such blocks may indicate security software interference, misconfiguration, or attempts to disrupt endpoint security monitoring.
Detects instances of the Windows utility RegSvcs.exe being executed from suspicious, user-writable directories (such as Temp or Public folders) or instances where RegSvcs.exe is used to spawn common command-line or scripting tools, which is a common indicator of living-off-the-land binary (LOLBin) abuse.
This rule detects potentially malicious usage of the Windows RegSvcs.exe binary, often used as a proxy for executing code. It monitors for two specific patterns: RegSvcs.exe being executed from user-writable directories (e.g., C:\Users\, C:\ProgramData\), or RegSvcs.exe spawning suspicious child processes (e.g., PowerShell, cmd, WScript, mshta), which is indicative of a living-off-the-land (LotL) attack technique to bypass application control or execute payloads.
Detects the execution of known Windows accessibility binaries (e.g., sethc.exe, utilman.exe) where the internal metadata or original filename indicates that the process is actually cmd.exe. This is a common technique used by adversaries to gain unauthenticated command-line access with SYSTEM privileges via accessibility features, typically during the login screen process.
This rule monitors DeviceFileEvents for the presence of specific browser extension files on disk known to be associated with malicious campaigns. It utilizes a predefined mapping of extension IDs to names to identify and flag files matching the known malicious browser extensions.
Detects the use of command-line tools like curl, wget, PowerShell, or Python to perform DNS over HTTPS (DoH) queries, identified by specific command-line arguments and connections to known public DoH resolvers. This behavior can be indicative of attempts to bypass local DNS monitoring or security controls.
Detects PowerShell processes initiating network connections to known public DNS-over-HTTPS (DoH) providers over port 443. This behavior is often associated with efforts to bypass standard organizational DNS logging and security controls by tunnelng DNS queries through encrypted HTTPS traffic.
This rule detects activity associated with known indicators of compromise (IOCs) related to European political targeting campaigns. It monitors network, email, and authentication logs for connections to specific malicious domains (including .onion addresses) and IP addresses. The rule spans multiple data sources, including device network events, Entra ID sign-in logs, cloud application events, and email communications.
This rule detects network connections initiated by non-browser processes to domains commonly associated with software activation tools (e.g., massgrave.dev, activated.win). These domains are frequently used to download scripts or binaries related to unauthorized license activation, which may represent potential security risks or policy violations.
Page 4 of 15