Jason Nelson
@Jason6 followers485 downloads408 copies62 likes5,220 views
39 detections
Filters
Last updated
All Time
Detection languages
25
7
4
3
Categories
17
16
9
5
5
Platforms
25
10
3
2
1
Products / Services
8
3
3
3
2
MITRE Techniques
20
11
10
10
8
Detects active network communication associated with known malware that is being allowed by the Palo Alto Networks firewall. This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, potentially leading to system compromise, data exfiltration, or further infiltration within the network.
Catches MSI installer execution from browsers with silent installation flags, often used in FileFix attacks to install malware without user interaction.
Detects medium severity correlation events generated by Palo Alto Networks firewall's automated correlation engine. The correlation engine connects isolated network events and looks for patterns that indicate a more significant event. This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with a high probability that a host on the network has been compromised.
Detects allowed network traffic to the TOR network. Adversaries can use TOR to anonymize their network activity, bypass security controls, and evade detection while conducting malicious operations. This could lead to unauthorized access, data exfiltration, and compliance violations if deemed malicious.
This rule detects the creation of specific files named 'spinstall0' within the SharePoint Web Server Extensions template layouts directory. This activity could indicate an attempt to install or modify SharePoint components, potentially for malicious purposes or unauthorized changes.
This rule detects the execution of PowerShell with suspicious command-line arguments (such as base64 encoded strings, Invoke-Expression, or encoded commands) when the parent process is a web browser. This behavior is often indicative of drive-by downloads, malicious advertisements, or exploitation of browser vulnerabilities leading to the execution of malicious PowerShell scripts.
Detects successful Okta authentication using the FIDO/WebAuthn cross-device (hybrid) sign-in feature. This technique is abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns, like those conducted by PoisonSeed, to bypass FIDO MFA by tricking a user into scanning a malicious QR code.
Detects successful user authentication using the FIDO2/WebAuthn cross-device (hybrid) sign-in feature. This technique can be abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns to bypass FIDO key protections, as seen in the PoisonSeed campaign.
Detects the successful registration of a new FIDO2/WebAuthn security key for a user account. This activity can be legitimate, but attackers who have compromised an account may register their own FIDO key to maintain persistent access. This activity should be correlated with other suspicious events, such as a recent password reset or login from an unusual location.
Page 4 of 4