Information hacker
@Informationhacker0 followers7 downloads328 copies3 likes2,701 views
16 detections
Filters
Last updated
All Time
Detection languages
16
Categories
4
4
3
2
2
Platforms
9
3
3
1
1
Products / Services
8
4
1
1
1
MITRE Techniques
4
3
3
3
2
This rule detects sign-in attempts originating from IP addresses associated with Starlink (Space Exploration Technologies) autonomous system. This could indicate an unusual access vector, especially if Starlink is not a common or expected internet service provider for the organization's users.
KQL Query
This rule detects network connections from devices to a list of known malicious domains. These domains are often associated with command and control (C2) infrastructure or other malicious activities.
This rule detects brute force activity based on 'BruteForceActivityDetected' events from DeviceEvents. It identifies the attacking IP, the device being attacked, the credential being targeted, the workstation name, domain name, and the type of attack. It then summarizes the count of attacks per unique combination of these fields, ordered by the attack count.
This rule detects network connections to known cryptocurrency mining pools or processes associated with cryptocurrency mining. It identifies suspicious activity based on remote URLs, process names, and remote ports commonly used by miners.
This rule detects suspicious user-agent strings in Microsoft Graph activity logs that are commonly associated with reconnaissance and attack tools targeting Azure AD and Microsoft 365 environments. These tools include BloodHound, ROADtools, AADInternals, and various other utilities used for enumeration, credential spraying, and other malicious activities.
This rule detects the creation or modification of Chrome extension files (.crx) on a device, correlating it with browser extension installation/update events and file prevalence. It flags extensions that are rare, unsigned, small in size, or have suspicious IDs, indicating potential malicious activity or unauthorized installations.
Detects the creation or modification of Exchange inbox rules that move messages to potentially risky folders (e.g., Deleted Items, Junk Email, RSS Feeds, Archive, Clutter) or are configured to delete messages. This behavior can be indicative of an attacker attempting to hide malicious emails, exfiltrate data, or disrupt email flow.
This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.
This rule detects anomalous process executions originating from the SolarWinds Web Help Desk application. It monitors for any child processes spawned by the Web Help Desk application that are not part of a predefined allowlist of expected executables (java.exe, pg_dump.exe, reg.exe, conhost.exe, WerFault.exe) or command lines (mysqldump). This can indicate compromise or misuse of the application to execute arbitrary code.
Page 1 of 2