ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,088 copies12 likes3,491 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
Detects the creation of specific GitHub repositories ('tpcp-docs' or 'docs-tpcp') associated with TeamPCP stealer fallback exfiltration activity, including subsequent release or asset creation.
Detects established git actors (seen >7 days ago) originating from a newly observed source IP address (first seen within 24 hours) that perform a high volume of git operations (>=15) across multiple distinct repositories (>=10). This behavior often indicates compromised developer credentials being used to enumerate and clone source code repositories.
Detects the execution of known remote administration and monitoring tools (such as Atera, Syncro, Splashtop, AnyDesk, TeamViewer, ScreenConnect, etc.) originating from user-writable or temporary directories (such as AppData, ProgramData, Users, Downloads, Windows Temp) and spawned by common application or system processes (such as browsers or explorer).
Detects file creation or modification events targeting specific Google Chrome extension paths, specifically involving known extension IDs associated with malicious activity or unauthorized modifications.
Detects when the System Center Configuration Manager (SCCM / ConfigMgr) client service (CcmExec) is stopped or running based on Windows Event Log System events from the Service Control Manager (EventCode 7036).
Detects registry modifications related to Google Chrome and Microsoft Edge extension force-install policies (ExtensionInstallForcelist or ExtensionSettings) by processes other than svchost.exe. Attackers may abuse this to install malicious browser extensions for persistence or credential harvesting.
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
Detects file events involving NCrypt.exe, which may indicate process execution or file modification related to cryptographic functions or potential masquerading.
Detects the rare 'AssumeRoot' event in AWS STS followed by high-impact administrative or destructive API calls within a one-hour window. This behavior often indicates an adversary attempting to gain elevated, privileged access to perform unauthorized actions such as disabling logging, deleting infrastructure, or modifying IAM policies.
Page 34 of 35