ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,495 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects unauthorized access to virtual hard disk (VMDK) files by non-standard processes followed by the creation or modification of sensitive offline credential artifacts such as ntds.dit or SYSTEM hives on the same host within a 2-hour window, indicating potential offline credential theft.
Detects when a Bandizip executable loads an unsigned dynamic-link library (DLL) from outside the standard installation directory, where the Bandizip process was launched by explorer.exe, potentially indicating DLL side-loading.
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
Detects a high volume of Azure Key Vault secret reads or key decryption operations performed by a single caller identity from multiple source IP addresses within a one-hour window, which may indicate credential harvesting or unauthorized access.
Detects non-interactive service principal sign-ins originating from an IP address and location never seen for that specific principal over a prior 30-day baseline period, approximating potential misuse of stolen cloud credentials exposed via environment variables.
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Page 24 of 35