ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,088 copies12 likes3,489 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Detects a sequence of events on Linux hosts involving a remote interactive or network logon from an external IP, followed within 5 minutes by root-level process execution, and subsequently within 2 hours by an outbound SSH connection to a private or known attacker IP. Also includes a separate branch for direct logons from known malicious IPs.
Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.
Detects Gheist campaign activity: creation of a ci-sync-<6 chars> branch via stolen GitHub token followed within 10 minutes by a workflow run on that branch in the same repo. Requires GitHub audit log ingestion; table name is an assumption.
Detects when a user authenticates via device code flow or performs device registration/ownership addition, followed by a bulk download of SharePoint or OneDrive files (25 or more distinct files) within a 60-minute window. This behavior can indicate session hijacking or unauthorized access where an attacker uses device code phishing to gain access and quickly exfiltrate cloud documents.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Page 4 of 35