F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.
KQL Query
This rule identifies rare web browser extensions installed on Chrome or Edge browsers by monitoring file events for low-prevalence extension IDs. An extension is considered rare if it has been observed on fewer than 3 devices within the last 30 days. This pattern is often used to detect malicious or unauthorized extensions, which can be leveraged for persistence or credential theft.
KQL Query
KQL Query
KQL Query
KQL Query from file: client.dll sideload hunt - user-writable and staging paths only (steam dll inpersonatin)
Detects network connections to uncommon or suspicious top-level domains (TLDs) initiated by processes other than standard web browsers. The rule filters out known browser processes and analyzes network traffic patterns, including connection count and prevalence across the fleet, to identify potentially anomalous or malicious C2 activity.
Detects the use of PowerShell commands 'irm' (Invoke-RestMethod) or 'iwr' (Invoke-WebRequest) to download content from a direct IP address. This pattern is commonly used by attackers to stage malicious payloads or tools directly from external infrastructure, bypassing domain-based reputation filters.
This rule identifies rarely executed Windows binaries that are listed in the LOLBAS (Living Off the Land Binaries and Scripts) project dataset. By comparing process execution events from the last 30 days against the official LOLBAS list, it surfaces the least frequently used binaries, which may indicate unusual activity or potentially malicious use of legitimate system tools.
Page 6 of 15