ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,494 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects when a USB mass storage device is connected to a host and is followed shortly thereafter by a large volume of file creations or modifications on a removable drive, which may indicate data exfiltration or staging.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Detects potential data staging and exfiltration where sensitive or investigation-related files are compressed using archive utilities or PowerShell, followed closely by upload activities to Backblaze B2 cloud storage via CLI tools, rclone, or direct API connections.
Detects a sequence of FTP SITE CPFR (Copy From) followed by SITE CPTO (Copy To) commands from the same source IP and computer within 5 minutes, which can be abused to copy files on the server.
Correlates a running ProFTPD FTP server process listening on TCP port 21 with commands checking or loading the mod_copy module on the same Linux device using Microsoft Defender XDR telemetry.
Detects VPN connection events where the client hostname contains the string 'kali', which may indicate the use of a penetration testing operating system or a suspicious device connecting to the corporate network via Palo Alto Networks GlobalProtect.
Detects outbound network connections to domains associated with the AdFection / Discover-Tech / Controlium threat infrastructure using a Sentinel watchlist, filtering out known browser activity or allowing custom domain lists.
Detects PowerShell processes spawned via shortcut files (lnk) using suspicious command-line parameters that subsequently create both a text file and a Discord-named executable on the same device within a 10-minute window.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Page 26 of 35