F S
@FsdrTrusted contributorCompletionist
10 followers126 downloads2,750 copies132 likes25,410 views
147 detections
Filters
Last updated
All Time
Detection languages
147
Categories
60
38
26
17
13
Platforms
112
20
15
14
13
Products / Services
95
19
16
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Detects instances where 'curl.exe' is used to download content related to Node.js, specifically looking for 'nodejs.org' or 'node-v' in the command line. This could indicate an adversary attempting to download and execute a Node.js runtime or related tools on a compromised system.
Detects the creation or modification of a registry run key that establishes persistence by executing 'conhost' or 'node.exe' with '--headless' or '.cfg' arguments. This technique is often used by adversaries to maintain access to a system after a reboot or user login.
This rule detects common PowerShell patterns used for downloading content from the internet and then executing it. It looks for a combination of download-related commands/objects (e.g., DownloadString, Invoke-WebRequest, Net.WebClient) and execution-related commands/objects (e.g., IEX, Invoke-Expression, Invoke-Command, ScriptBlock) within PowerShell command-line activity. This behavior is frequently observed in malware and adversary tradecraft for initial access, execution, and persistence.
This rule detects PowerShell commands indicative of reflective code loading, specifically looking for the use of 'Assembly' and 'Load' or 'GetType' and 'Invoke' within PowerShell command arguments. It filters out common noise associated with legitimate PowerShell operations like PSGet, Cursor, and internal Microsoft PowerShell modules to reduce false positives.
This rule detects the execution of processes with filenames starting with 'claude' on server devices. It specifically targets server endpoints by filtering device information to include only 'Server' device types and then joins this with process execution events. This could indicate the presence or execution of AI-related tools or unauthorized software on critical infrastructure.
This rule detects the creation or modification of Exchange inbox rules with highly suspicious or obfuscated names. Adversaries often create inbox rules with short, non-descriptive, or special character names (e.g., '.', '...', ';') to forward, redirect, or delete emails, facilitating data exfiltration or maintaining persistence. The rule specifically looks for rule names that are very short (less than 3 characters), empty, or match a predefined list of suspicious names.
KQL Query
Detects when the security event log has been cleared by an account that is not the built-in system administrator (SID ending in 500). This activity is often performed by adversaries to remove traces of their actions.
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
This rule detects and monitors sign-in attempts to third-party Artificial Intelligence (AI) applications within an organization's environment. It identifies sign-ins to known AI vendors and tools by matching keywords in application display names and resource display names from Entra ID (formerly Azure AD) sign-in logs. The rule specifically excludes Microsoft's own Copilot products to focus on 'shadow AI' usage. It aggregates sign-in attempts, successes, failures, unique users, and common failure reasons to provide insights into the adoption and potential risks associated with unsanctioned AI tool usage.
Page 9 of 15