ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,495 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects script files (PHP, JSP, etc.) created or renamed within web root directories by the ProFTPD process, indicating potential exploitation of the mod_copy module (CVE-2015-3306) to upload web shells.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects a sequence of AWS API calls where an external IP first calls sts:GetCallerIdentity, followed by Bedrock model listing APIs, and subsequently IAM or account/trail discovery events within a short timeframe, indicating potential cloud reconnaissance or unauthorized access.
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Detects the execution of NetSupport Manager client binaries (client32.exe or pcictlui.exe) from user-writable directories such as AppData, ProgramData, or Public folders, optionally spawned by script loaders or command interpreters.
Detects five or more Entra ID device registrations by a single account where device names match microsoft-* or WINDOWS-* patterns, occurring shortly after a device code flow sign-in by the same account. This behavior is indicative of device registration abuse or persistent access attempts.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Detects non-browser processes contacting multiple distinct cloud storage APIs within a one-hour timeframe, a pattern indicative of potential multi-service command and control or data exfiltration.
Detects inbound emails impersonating OpenCode breach notices that urge API key rotation and contain links to non-OpenCode domains.
Page 22 of 35