Georgios Maragos
@GmarakGreeceCompletionist
2 followers501 downloads300 copies8 likes5,907 views
46 detections
Filters
Last updated
All Time
Detection languages
45
1
Categories
21
14
8
6
4
Platforms
25
10
4
4
4
Products / Services
12
8
5
4
4
MITRE Techniques
18
8
8
8
7
CVEs
3
2
1
1
1
Detects potentially malicious use of the device code authentication flow in Entra ID sign-in logs. The rule correlates device code usage with indicators of suspicious activity, such as rare User-Agent strings (e.g., 'python-requests') often used in phishing/relay toolkits, or sign-ins flagged by Azure AD Identity Protection as risky. It includes exclusions for known first-party Azure CLI and PowerShell clients to minimize noise from legitimate administrative activity.
Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.
This rule detects the creation of a Windows service named 'SecurityHealthIron' using the sc.exe utility or direct service creation calls. This specific naming convention is often associated with suspicious or potentially malicious activity attempting to masquerade as a legitimate Windows Security Health service.
Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.
Detects the execution of .crx Edge extension files where the parent process is Microsoft Teams, often indicating social engineering attacks delivering malicious extensions.
This rule detects extortion emails that claim corporate data theft and threaten public release unless a cryptocurrency payment is made. It looks for a combination of breach-related subject lines, extortion-specific language in the email body, and indicators such as specific cryptocurrency mentions, urgent deadlines, usage of anonymous email providers, or references to attached proof of compromise.
Detects the mounting of an ISO image via PowerShell using the Mount-DiskImage cmdlet. This behavior has been observed as a required preparation step for the RoguePlanet Windows Defender Local Privilege Escalation (LPE) proof-of-concept, which abuses Windows Defender behavior to elevate privileges from a standard user context to SYSTEM on fully patched Windows 10 and Windows 11 systems.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
Detects execution and persistence mechanisms associated with the
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
Detects potentially malicious SMB activity associated with GhostLock-style
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
Page 4 of 5