Jason Nelson
@Jason6 followers485 downloads408 copies62 likes5,220 views
39 detections
Filters
Last updated
All Time
Detection languages
25
7
4
3
Categories
17
16
9
5
5
Platforms
25
10
3
2
1
Products / Services
8
3
3
3
2
MITRE Techniques
20
11
10
10
8
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Detects the use of PowerShell to perform a fileless download-and-execute operation, characterized by the presence of web-based download cmdlets alongside in-memory execution primitives. This pattern is commonly used for staging malicious payloads such as Cobalt Strike, Sliver, or other offensive tooling while avoiding file-based detection.
This rule monitors Palo Alto Networks firewalls for files identified as malicious by the WildFire or ML-based threat detection engines. It filters out known allowed file hashes and aggregates events to provide a high-confidence alert. The rule categorizes threats based on the verdict ('malicious', 'malware', 'phishing', 'suspicious', 'c2') and distinguishes whether the threat was blocked or delivered to the network, providing context for incident response.
This rule detects suspicious DNS queries made by common Windows command-line interpreters and scripting engines. It specifically looks for `nslookup.exe` or `dig.exe` being spawned by `cmd.exe`, `powershell.exe`, `pwsh.exe`, `explorer.exe`, `wscript.exe`, `cscript.exe`, or `mshta.exe`. The detection is further refined by looking for specific DNS query types (TXT, MX, SRV, AAAA), service records (`._tcp.`, `._udp.`), or `.onion` domains in the command line. Additionally, it requires corroboration through the presence of an IP address or `-server=` in the command line, or specific PowerShell/command-line obfuscation/execution techniques, or suspicious top-level domains (TLDs) like `.xyz`, `.top`, `.tk`, `.ru`, `.cn`, `.cc`, `.ws`, `.pw`, `.onion`, `.direct`, `.surf`. The rule explicitly excludes queries to `localhost` or common legitimate DNS records like `_dmarc.`, `_dkim.`, `_spf.`, `_acme-challenge.`, `_domainkey.`, `_msdcs.` to reduce false positives.
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
FileFix is a sophisticated social engineering attack, emerging in mid-2025, that abuses the Windows File Explorer address bar to execute malicious PowerShell commands. It is an evolution of the "ClickFix" technique, shifting from the Run dialog (Win+R) to the Explorer address bar (Ctrl+L).
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
This rule detects outbound SSH (Secure Shell) connections initiated by common SSH client executables (ssh.exe, ssh, plink.exe, dbclient.exe) to external IP addresses. It explicitly excludes connections to common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback address (127.0.0.0/8) to reduce false positives from internal network activity.
Detects potential malicious email execution chains where Microsoft Outlook spawns suspicious child processes (e.g., powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
This rule detects PowerShell or pwsh.exe process creations that include command-line arguments indicative of image file manipulation and obfuscation techniques. Specifically, it looks for the presence of image file extensions (.png, .jpg, .jpeg, .gif, .bmp, .tiff, .tif) combined with PowerShell commands or .NET methods related to base64 decoding, expression invocation, command invocation, GDI+ graphics operations (System.Drawing, Bitmap, GetPixel, SetPixel, LockBits, UnlockBits, PixelFormat), or file content reading ([IO.File]::ReadAllBytes, Get-Content). Additionally, it checks for common obfuscation or execution flags such as '-enc', '-encoded', '-e', '-w hidden', '-windowstyle hidden', '-nop', '-noprofile', '-ep bypass', or '-executionpolicy bypass'. This combination suggests an attempt to execute malicious code hidden within image files, often using steganography or other covert methods.
Page 1 of 4