ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,088 copies12 likes3,491 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Detects the sequential relationship of data staging using tools like WinRAR and subsequent exfiltration using tools like Rclone, WinSCP, or FileZilla on a single host within a 24-hour window.
Detects incoming emails containing QR code references in the body along with registration/invitation subjects and common document or image attachments, where the QR code URL is either missing (undecoded) or points to domains other than Google Forms, potentially indicating a phishing attempt attempting to bypass standard URL inspection.
Detects instances where an OAuth token is used from a new IP address and a new country within 24 hours of a successful device-code sign-in for the same user, potentially indicating token theft or abuse.
Detects PowerShell processes spawned by common managed file transfer (MFT) or web service processes (such as Serv-U, GoAnywhere, MOVEit, Cleo, Tomcat, etc.) performing remote system discovery or ingress tool transfer activities.
Detects the execution of archiving utilities (7z, rar, tar, or Compress-Archive) targeting configuration directories of AI coding assistants such as Claude, Codex, Cursor, and Gemini.
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Detects suspicious command-line execution patterns involving 'ccmpwn', coercing features, or manipulation of Configuration Manager configuration files such as SCNotification.exe.config.
Detects hosts exhibiting multiple persistence mechanisms (Run keys, Scheduled Tasks, and Windows Services) within a short timeframe, indicating potential adversary persistence setup.
Detects process creation events where common Office applications (Word, Excel, PowerPoint, Outlook) or archive/reader utilities (Acrobat, WinRAR, 7-Zip) act as the parent process to command-line interpreters, scripting engines, or administrative tools (such as cmd, powershell, wscript, cscript, mshta, rundll32, and others). This behavior is commonly associated with phishing attacks, macro execution, or exploitation of file formats leading to code execution.
Page 31 of 35