Thiru N
@IamthiruIndiaCompletionist
3 followers220 downloads464 copies23 likes18,732 views
70 detections
Filters
Last updated
All Time
Detection languages
55
8
3
2
1
Categories
26
22
16
10
10
Platforms
45
15
9
7
2
Products / Services
8
5
5
4
3
MITRE Techniques
19
18
18
14
12
CVEs
1
Detects the creation of a Cloud Files API sync root with the specific provider name 'SERIOUSLYMSFT' used by the RedSun LPE exploit to abuse Windows Defender's cloud file rollback mechanism. This rule looks for the specific string 'SERIOUSLYMSFT' in registry value updates (RegValueUpdate) or in command-line arguments of executed processes (ProcessRollup2).
Detects network connections, DNS requests, and HTTP traffic to known Tropic Trooper C2 infrastructure, indicating potential AdaptixC2 or Cobalt Strike beaconing from compromised endpoints.
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
Detects the creation of a Cloud Files API sync root with the specific provider name 'SERIOUSLYMSFT' used by the RedSun LPE exploit to abuse Windows Defender's cloud file rollback mechanism. This rule looks for the specific string 'SERIOUSLYMSFT' in registry value updates (RegValueUpdate) or in command-line arguments of executed processes (ProcessRollup2).
Detects the creation of hidden local accounts using the 'net user' command where the username ends with a '$' symbol. This technique is used by the Andariel group for RID hijacking attacks to maintain stealthy persistence.
Detects the creation of hidden local accounts using the 'net user' command where the username ends with a '$' symbol. This technique is used by the Andariel group for RID hijacking attacks to maintain stealthy persistence.
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
Detects the creation of symbolic links targeting the Restricted kernel object namespace, which the BlueHammer exploit uses for path confusion during a TOCTOU race condition to achieve Local Privilege Escalation.
Detects the systemic deletion of Windows event logs using a tight loop with wevtutil.exe, a defense evasion tactic used by Kyber ransomware to impair investigations.
This rule detects the use of PowerShell to re-enable the Server Message Block version 1 (SMB1) protocol on Windows systems. SMB1 is a deprecated and insecure protocol, and its re-enablement often indicates an attempt to support legacy systems or could be exploited by adversaries for lateral movement or data access.
Page 6 of 7