Jason Nelson
@Jason6 followers485 downloads408 copies62 likes5,220 views
39 detections
Filters
Last updated
All Time
Detection languages
25
7
4
3
Categories
17
16
9
5
5
Platforms
25
10
3
2
1
Products / Services
8
3
3
3
2
MITRE Techniques
20
11
10
10
8
Detects potential abuse of Microsoft Actor tokens for cross-tenant impersonation attacks targeting Entra ID tenants. This rule identifies suspicious audit log entries that may indicate exploitation of CVE-2025-55241, a critical vulnerability in Azure AD Graph API that allowed attackers to impersonate any user across Entra ID tenants using malicious Actor tokens.
Detects instances where PowerShell is used to download content from external domains using common web request methods (Invoke-WebRequest, iwr, wget, DownloadFile, DownloadString). This behavior is frequently observed during the initial stages of malware delivery, including payload staging or C2 beaconing. The rule excludes known benign sources like slackb.com/error and chocolatey and filters out system-level accounts to reduce false positives.
Detects unauthorized modifications to the Palo Alto Networks firewall configuration, potentially indicating malicious activity or security policy violations. These changes can be leveraged to evade detection, facilitate data exfiltration, or disrupt network defenses, ultimately compromising the integrity and security of the environment.
Identifies DNS queries to non-standard ports, often used for DNS tunneling or C2. **Validation**: High - DNS to non-53 ports is rarely legitimate.
Identifies command prompt execution from browsers with suspicious parameters, indicating potential ClickFix attacks where users are tricked into running malicious commands.
Catches outgoing network connections to external IPs from command-line tools spawned by browsers, indicating potential command-and-control communication in ClickFix attacks.
Catches registry modifications that disable security features like Windows Defender, often part of ClickFix attacks where users are told to “fix” security issues by disabling protection.
Detects clipboard manipulation from browser processes, often used in ClickFix attacks where malicious content is copied to the clipboard for users to paste into terminals.
This rule detects the creation of a new process (cmd.exe) that is spawned by a w3wp.exe process, which itself is a child of svchost.exe, and where the command line of the w3wp.exe process contains the string "SharePoint". This chain of events could indicate suspicious activity within a SharePoint environment, potentially an attacker executing commands via a compromised IIS worker process.
This rule detects the execution of 'csc.exe' (C# compiler) when it attempts to create or interact with a file named 'App_Web_spinstall0.aspx'. This specific file name is often associated with web shell activity or malicious code compilation on web servers, particularly in the context of .NET applications. The rule aims to identify potential malicious compilation and execution of web-based backdoors or implants.
Page 2 of 4