ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,088 copies12 likes3,491 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.
Detects processes accessing sensitive files and configurations associated with multiple AI coding assistants (such as Claude, Codex, Grok, and Cursor) within a short time window, potentially indicating unauthorized access or credential theft from AI tools.
Detects when a single AWS user identity or IP address enumerates multiple resources across different AWS services (such as SQS, Lambda, ECS, CodeDeploy, S3, RDS, Athena) within a short time window, indicating potential reconnaissance or discovery activity.
Detects searches for the specific Android application package name 'com.ballbounce.Hizbartech', which may indicate investigation into potentially malicious or unwanted applications.
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
Detects non-browser processes accessing multiple sensitive browser credential/cookie files or cryptocurrency wallet files within a 24-hour window, which is a common indicator of credential theft or information stealer activity.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Page 32 of 35