Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
This rule detects the creation of specific file types (batch scripts, command scripts, VBScripts, JScripts, PowerShell scripts, or shortcut files) within the Windows Startup folder. This activity is often used for persistence, allowing an attacker's code to execute automatically when a user logs in or the system starts.
This rule detects PowerShell script blocks that exhibit characteristics of highly obfuscated and potentially malicious code. Specifically, it looks for the combination of:
1. Compression techniques (using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream').
2. Base64 decoding (using 'FromBase64String' or 'Convert::FromBase64').
3. Assembly loading via reflection (using 'Reflection.Assembly' or 'Assembly]::Load').
This combination is frequently used by attackers to hide malicious payloads, decompress them, decode them, and then load them into memory for execution, bypassing traditional file-based detection.
1. Compression techniques (using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream').
2. Base64 decoding (using 'FromBase64String' or 'Convert::FromBase64').
3. Assembly loading via reflection (using 'Reflection.Assembly' or 'Assembly]::Load').
This combination is frequently used by attackers to hide malicious payloads, decompress them, decode them, and then load them into memory for execution, bypassing traditional file-based detection.
Detects PowerShell spawned by explorer.exe with extensive whitespace padding followed by comment characters and fake document paths. This technique is used in social engineering attacks where victims are instructed to paste commands into File Explorer, with malicious code hidden by whitespace and a visible fake path comment (e.g., "# C:\Documents\policy.docx") to appear benign.
Detects PowerShell download cradles that use commands like Invoke-RestMethod, Invoke-WebRequest, iwr, irm, curl, wget, Net.WebClient, DownloadString, DownloadData, or Start-BitsTransfer to download content, immediately followed by execution via Invoke-Expression or IEX. This technique is often used for fileless malware execution.
This rule detects when the security log (EventCode 1102) or the system log (EventCode 104) is cleared on a Windows machine. This activity can indicate an attempt by an attacker to remove forensic evidence of their actions.
This rule detects multiple HTTP POST requests originating from the same host to the same external IP address within a 10-minute window, with a minimum of 5 such events. This pattern is indicative of potential command and control (C2) beaconing activity, where a compromised system periodically communicates with an external server.
This rule detects the creation of scheduled tasks using schtasks.exe where the command line explicitly includes parameters for creating a task, specifying a system, a user, and a password. This combination of parameters is often used in lateral movement or persistence techniques by adversaries.
This rule detects a sequence of events on a Windows machine that could indicate a scheduled task being created and executed after a network logon. Specifically, it looks for a successful network logon (EventCode 4624, Logon_Type 3) followed by the creation of a scheduled task (EventCode 4698), and then the execution of a process (powershell.exe, pwsh.exe, cmd.exe, wscript.exe, or cscript.exe) that is a child of a scheduled task host process (taskeng.exe, taskhostw.exe, taskhost.exe, or svchost.exe with 'Schedule' in its command line). All these events must occur on the same computer within a 10-minute window.
Detects PowerShell scripts that perform a multi-stage obfuscation pattern involving the decompression of data using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream', followed by base64 decoding using 'FromBase64String' or 'Convert::FromBase64', and finally loading the resulting payload as a .NET assembly using 'Reflection.Assembly' or 'Assembly]::Load'. This combination of actions is indicative of malware delivery techniques.
This rule detects attempts to delete registry keys associated with the "ms-settings" URI scheme, specifically targeting the "Shell\Open\command" subkey. This activity could indicate an attempt to remove or disable a custom URI handler, which might be used by malware for persistence or execution. The rule focuses on Sysmon EventCode 12 (RegistryEvent) with EventType "DeleteKey" and a TargetObject matching "*\\ms-settings\\Shell\\Open\\command*". This could be an indicator of an attacker trying to clean up their tracks or disrupt legitimate system functionality.
Page 3 of 9