ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,495 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Identifies devices with Signal software flagged by Defender Vulnerability Management for CVE-2026-113380 (RingRTC before 2.72.0, hangup commands dropped when call state machine queue is flooded). Exposure rule, not an exploit detection; results are deduplicated per device and sorted by recent Signal activity.
Detects instances of GitLab and Ruby running vulnerable software versions based on software inventory checks against fixed release versions.
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Detects outbound network connections from processes targeting a known hard-coded Potassium campaign C2 IP address (134.199.154.64), followed by fallback DNS resolver queries using standard public DNS servers by the same process.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Correlates the modification of the Explorer Policies Run registry key (specifically the 'Loader' value) with the creation or modification of a .url shortcut file in the user Startup folder on the same device within a 1-hour window, using the same initiating process.
Detects registry-based User Account Control (UAC) bypass activity where command keys for ms-settings or mscfile are created or modified under HKCU Software\Classes, correlated with a privilege adjustment (SeDebugPrivilege or SeLoadDriverPrivilege) by the same process within a 30-minute window.
Detects the modification or setting of the execInstalledOnly parameter to false, 0, or disabled on VMware ESXi or Linux hosts via process execution command lines or syslog messages, often associated with running uninstalled or arbitrary scripts/binaries in virtualized environments.
Page 19 of 35