Thiru N
@IamthiruIndiaCompletionist
3 followers220 downloads464 copies23 likes18,732 views
70 detections
Filters
Last updated
All Time
Detection languages
55
8
3
2
1
Categories
26
22
16
10
10
Platforms
45
15
9
7
2
Products / Services
8
5
5
4
3
MITRE Techniques
19
18
18
14
12
CVEs
1
Detects the execution of the `crontab` binary by common web server service accounts on Linux systems. This activity is highly suspicious as it indicates an attacker leveraging remote code execution (RCE) in a web application to establish persistence via scheduled tasks.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects network connections to the known command and control (C2) server and port associated with the compromised axios package payload. This rule specifically looks for network connections or DNS requests to 'sfrclak.com' or connections to IP address '142.11.206.73' on port 8000.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
CrowdStrike Query – Potential Notepad Abuse via WindowsApps
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
This rule detects the execution of reconnaissance commands (whoami, tasklist, systeminfo, netstat) via `cmd.exe` where the parent process is either `GUP.exe` or `AutoUpdater.exe`. This behavior is indicative of the Notepad++ supply chain attack, where malicious updates could execute system reconnaissance commands. The detection specifically looks for output redirection, which is a common technique for adversaries to save command output.
SPL Query
SPL Query
Page 7 of 7