ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,494 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects a sequence where an assumed-role credential from an external IP calls sts:GetCallerIdentity followed by listing Amazon Bedrock foundation models within a one-hour window, potentially indicating reconnaissance of AI/ML services by an external threat actor.
Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects repeated crashes of GitLab Ruby, Puma, Sidekiq, or bundle processes on Linux within a short time window. The detection looks for crash markers such as segfault, SIGSEGV, SIGABRT, or onigmo in the command line, which typically indicate exploitation attempts against Onigmo regex engine vulnerabilities.
Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Detects potential persistence establishment where an AOMEI-related process writes a DLL file to disk, followed by the creation or modification of a Windows service pointing to that same DLL within a 15-minute window.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Page 23 of 35