F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
This rule monitors for file-level artifacts related to the ModHeader browser extension, specifically targeting folder paths and file names that match the extension's unique ID. This is typically used to identify the installation or download of this extension, which has been associated with malicious activity.
Detects network connections originating from browser processes to domains associated with ModHeader-related C2 activity, specifically 'stanfordstudies.com' and 'extensions-hub.com'. This pattern is indicative of malicious browser extensions exfiltrating data or reaching out to command and control infrastructure.
Detects the installation of Python on Windows systems using various package managers (WinGet, Chocolatey, Scoop), MSI installers, or direct download methods via command-line utilities like PowerShell, curl, or wget.
Detects modifications or creations of Image File Execution Options (IFEO) registry keys where a 'Debugger' value is set. IFEO is a feature that allows a debugger to be attached to an executable, which is often abused by attackers for persistence, privilege escalation, or defense evasion by executing malicious code when the target application launches.
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
Detects instances where users click links directing to Proton Drive domains, a common vector for device code phishing and credential harvesting attacks.
Detects inbound or intra-organizational emails that contain URLs associated with Proton Drive services. This rule is specifically designed to identify potential device code phishing attempts or malicious document distribution utilizing Proton Drive's infrastructure.
This rule monitors DeviceFileEvents to detect the installation of a known malicious browser extension, 'VPN Go: Free VPN'. By matching file activity against the extension's unique ID, this detection helps identify potential browser-based threats, such as information stealer functionality or persistent backdoors installed via malicious extensions.
Detects email notifications regarding the addition of a new Personal Access Token (PAT) to a GitHub account. This activity is often a precursor to unauthorized API access if an adversary has compromised a user's account.
Detects the use of the C# compiler (csc.exe) to compile code that references the 'System.Management.Automation' assembly. This pattern is commonly used in 'PS2EXE' techniques or custom loaders to execute PowerShell functionality from within a compiled binary, often to evade security controls that monitor for direct powershell.exe usage.
Page 7 of 15