Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,995 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
Detects node.exe spawning potentially malicious child processes such as curl, cscript, wscript, powershell, or cmd where the command line does not reference the legitimate npm registry. During normal npm operations, node should resolve packages and write to node_modules, not shell out to system utilities for downloading or executing scripts. This behavior was observed in the axios npm supply chain compromise (March 2026), where a trojanized postinstall hook in plain-crypto-js caused node to spawn curl and cscript to fetch and execute stage-2 RAT payloads from an external C2 server. This detection excludes legitimate npm registry traffic to reduce false positives from normal package installation activity.
Detects command-line tools and scripts used to clear Windows Event Logs, indicating potential anti-forensics activity to hide evidence of malicious actions.
This rule detects suspicious PowerShell activity by monitoring Windows events for process creation (EventCode 13) or registry modifications (EventCode 4657) that involve PowerShell or pwsh. It specifically looks for the use of obfuscation or evasion techniques within the command details, such as 'iex', 'Invoke-Expression', 'DownloadString', 'DownloadFile', '.Net.WebClient', 'FromBase64String', hidden window styles ('-w hidden', '-windowstyle hidden'), execution policy bypass ('-ep bypass', '-executionpolicy bypass'), or encoded commands ('-enc', '-encodedcommand'). This combination of event codes and keywords suggests an attempt to execute malicious or obfuscated PowerShell scripts.
Detects scheduled tasks created on remote systems using explicit credentials.
This rule detects the creation of scheduled tasks using `schtasks.exe` where the task is configured to run with elevated privileges (Administrator, SYSTEM, or NT AUTHORITY) and is intended for remote execution (indicated by the `/s` switch) but explicitly excludes local host targets. This pattern is often indicative of lateral movement or persistence mechanisms where an attacker establishes a scheduled task on a remote system to execute malicious code with high privileges.
Detects scheduled task creation where the task action executes files from Windows Startup folders. This layered persistence combines scheduled tasks (flexible triggers, potential privilege escalation) with startup folder execution for redundancy and resilience.
Detects critical Windows system processes spawning unusual child processes. While these processes rarely spawn command shells or scripting interpreters legitimately, this behavior could indicate PPID spoofing, process injection, or other malicious process manipulation techniques.
This rule detects successful SSH authentication attempts originating from IP addresses that are not classified as private (non-RFC1918). It specifically looks for log entries indicating 'Accepted password' or 'Accepted publickey' and then filters out source IP addresses that fall within common private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16). The rule is designed to identify SSH access from external networks, which might be unusual in environments where SSH is expected to be primarily internal. It does not account for IPv6 private addresses.
This rule detects potential command injection attempts within the username field of Palo Alto Networks system logs. It specifically looks for various command injection indicators such as backticks, semicolons, logical operators (&&, ||), command substitution ($()), directory traversal (../), and common command-line utilities (wget, curl, chmod, sh, bash, ./, nc) within the 'User ' string in the raw log. The rule then extracts the potentially injected username and the source IP address for further investigation.
Page 1 of 9