F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Detects the use of 'pushd' via cmd.exe, powershell.exe, or pwsh.exe to mount remote UNC or WebDAV paths. This command allows users to map a network share to a temporary drive letter and change the current working directory, which is frequently used by adversaries to access remote shares or stage tools.
Detects instances where the 'forfiles.exe' utility is executed by 'explorer.exe'. This is an atypical parent-child process relationship that may indicate an attempt to use 'forfiles' for indirect command execution or to facilitate malicious actions while avoiding direct command prompt usage.
This rule detects the use of the 'pushd' command in the Windows Command Shell (cmd.exe) to mount a remote network share, immediately followed by the execution of a file on that remote share using 'rundll32.exe'. This pattern is a common technique used by attackers to execute malicious code (DLLs) stored on remote servers or network shares.
Detects instances where rundll32.exe is used to execute a file with a suspicious non-DLL extension (such as .tmp, .dat, .bin, .jpg, etc.) by specifying an exported function via an ordinal number. Adversaries often use this technique to proxy malicious code execution while attempting to evade security tools that only look for standard .dll extensions.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Detects the use of 'credwiz.exe' with the 'B' argument, which indicates a credentials backup operation. This activity could be indicative of an adversary attempting to dump credentials from a compromised system.
This rule detects the execution of processes where the original file name contains 'autoit' but the current file name does not, which can indicate obfuscation or malicious use of AutoIt scripts.
This rule detects instances where 'node.exe' or 'bun.exe' are executed from common user-writable directories (AppData, ProgramData, Public Users, Temp) and are initiated by common Windows shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe). It excludes executions from known legitimate development-related paths to reduce false positives.
This rule identifies recurring antivirus detections on endpoints, specifically filtering out common false positives originating from browser cache directories. It aggregates detections by device, threat name, and device ID, and flags instances where the same threat has been detected on at least two distinct days within a 30-day lookback period. This helps to highlight persistent malware issues rather than transient or benign detections.
This rule detects the execution of 'vsce-sign.exe' with command-line arguments indicating the verification of cached VS Code extensions. This activity is part of the normal VS Code extension installation and update process, where extensions are verified for integrity and authenticity. While this is a legitimate process, monitoring it can be useful for identifying anomalies or potential supply chain compromises if unexpected extensions are being verified or if the verification process itself is being abused.
Page 8 of 15