Thiru N
@IamthiruIndiaCompletionist
3 followers220 downloads464 copies23 likes18,732 views
70 detections
Filters
Last updated
All Time
Detection languages
55
8
3
2
1
Categories
26
22
16
10
10
Platforms
45
15
9
7
2
Products / Services
8
5
5
4
3
MITRE Techniques
19
18
18
14
12
CVEs
1
Detects the BlueMoon exploit kit's post-exploitation activity, specifically identifying when a Chromium-based browser process (chrome.exe or msedge.exe) initiates command-line tools such as cmd.exe, powershell.exe, or curl.exe to download and execute a secondary payload named 'msgbox.exe' within the user's temporary directory.
Detects execution of the 'socat' utility with command-line arguments indicating the establishment of a network listener. Socat is a multipurpose relay tool that can be abused by adversaries for pivoting, proxying traffic, or creating reverse shells by establishing listener ports.
Detects code injection attempts targeting the Windows Media Network Sharing Service (wmpnetwk.exe), specifically monitoring for the loading of suspicious or common networking-related DLLs into this process. This behavior is indicative of an adversary attempting to mask malicious activity within a legitimate system process.
Detects execution of common reconnaissance and system discovery commands (e.g., whoami, netstat, ifconfig) initiated by web server or application runtime processes (e.g., httpd, nginx, tomcat, node). This behavior is highly indicative of post-exploitation activity where an adversary attempts to gather system or network information after successfully compromising a web-based service.
Detects suspicious modifications to browser 'Secure Preferences' files associated with known bypass techniques for extension integrity checks, coupled with browser process termination and subsequent relaunch using the --restore-last-session flag. This pattern is consistent with adversary activity attempting to inject malicious browser extensions by manipulating browser configuration files.
This rule detects potentially unauthorized process executions (such as shells, network utilities, or enumeration tools) originating from TeamCity server processes (java.exe, javaw.exe). It filters out known TeamCity build agent or maintenance activities to highlight deviations from standard server behavior.
Generic rule content from file: Translated CQL Rule
Certighost
KQL
These credentials are used to perform DCSync or other activities, resulting in logon events from domain controller computer account originating from a non-domain controller IP address.
An adversary may be leveraging the compromised Visual Studio Code extension nrwl.angular-console-18.95.0 to gain initial access, execute malicious code, or compromise developer environments through trusted VSCode extension installations.
This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise.
Page 1 of 7