ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,085 copies12 likes3,481 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects an Active Directory password spray attack originating from a single source IP, followed closely by a user account creation event (Event ID 4720) associated with a logon from that same source IP.
Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Correlates an interactive MFA-satisfied user sign-in with a subsequent non-interactive or token-based successful authentication from a different IP address and country within a short time window for the same user and application. This pattern is indicative of adversary-in-the-middle (AitM) phishing attacks where session cookies or tokens are intercepted and replayed.
Detects the installation or execution of unauthorized Remote Monitoring and Management (RMM) tools such as MeshCentral, Atera, Teramind, AnyDesk, or AdaptixC2 artifacts on endpoints. It flags devices running multiple distinct RMM tools or featuring AdaptixC2.
Detects the creation or modification of inbox rules in Exchange Online that target financial-related keywords and hide/delete mail, or rules that mark all incoming mail as read and delete them, which may indicate a Business Email Compromise (BEC) attack or mailbox evasion technique.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Page 1 of 35