Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
This rule detects modifications to specific registry keys associated with the 'ms-settings' URI scheme. Specifically, it looks for changes to the '(Default)' or 'DelegateExecute' values under 'ms-settings\Shell\Open\command'. Such modifications could indicate an attempt to hijack the 'ms-settings' URI handler to execute arbitrary commands or programs when a user tries to open Windows settings, potentially leading to persistence or privilege escalation.
This rule detects the creation of scheduled tasks that are configured to execute programs from common Windows startup folders. It specifically looks for the use of 'schtasks.exe' with the '/create' and '/tr' (task run) arguments, or PowerShell commands 'Register-ScheduledTask' with '-Action' arguments. The rule then filters these activities to identify instances where the command line specifies paths within 'Start Menu\Programs\Startup' or '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup', which are common locations for persistence.
This rule detects lateral movement via scheduled tasks by correlating three distinct events within a 10-minute window on the same computer and for the same user. First, it identifies a successful network logon (EventID 4624, LogonType 3), excluding machine accounts and anonymous logons. Second, it looks for the creation of a scheduled task (EventID 4698). Third, it detects the execution of suspicious processes (PowerShell, cmd, wscript, cscript) where the parent process is either svchost.exe (with 'Schedule' in its command line) or taskeng.exe/taskhostw.exe/taskhost.exe, indicating execution by the Task Scheduler. This sequence suggests an attacker authenticating remotely, creating a scheduled task, and then immediately executing it.
This rule detects the use of the 'chmod' command to set overly permissive file permissions, specifically '777' (read, write, and execute for all users) in either octal or symbolic notation. It looks for 'chmod' as the executed command and then checks its arguments for '777', '0777', 'a=rwx', 'ugo+rwx', or 'a+rwx'. This activity can indicate a misconfiguration, a security vulnerability being introduced, or an attempt to bypass security controls.
This rule detects suspicious PowerShell commands that are written to the Windows registry. It specifically looks for registry events where the 'Details' field contains keywords indicative of PowerShell execution ('powershell', 'pwsh') combined with suspicious command elements. These suspicious elements include obfuscation flags or download capabilities such as 'iex', 'Invoke-Expression', 'DownloadString', 'DownloadFile', 'Net.WebClient', 'FromBase64String', '-w hidden', '-windowstyle hidden', '-ep bypass', '-executionpolicy bypass', '-enc ', and '-encodedcommand'. The presence of such commands in the registry may indicate a persistence mechanism, a configuration backdoor, or automated malware execution.
This rule detects attempts at command injection within the username field during authentication on Palo Alto firewalls. It specifically looks for patterns indicative of shell injection, including backtick-wrapped payloads (relevant to CVE-2024-9474), command separators like ';', '&&', '||', command substitution using '$()', directory traversal attempts ('../', './'), and the presence of common command-line utilities such as 'wget', 'curl', 'chmod', 'sh', 'bash', and 'nc' within the authentication message. The detection is based on system logs that record user authentication attempts.
Detects HTTP C2 beaconing patterns based on multiple requests (at least 5 within 5 seconds) to the same destination (source IP, destination IP, and destination port) where each request has a small response body (between 1 and 499 bytes). This rule correlates with 'Small HTTP Response Body' to identify burst request counts indicative of C2 activity.
The rule detects large file transfers where the MIME type is declared as 'text/plain' but the file size exceeds 1,000,000 bytes. It specifically looks for files originating locally and excludes transfers to internal IP addresses. This behavior is often used by C2 frameworks to disguise binary payloads or exfiltrated data as harmless text to evade proxy inspection.
The rule detects when Windows Event Logs are cleared. Specifically, it looks for Event ID 1102, which indicates the Security log was cleared, or Event ID 104, which indicates the System log was cleared. This activity is often associated with anti-forensics techniques to hide malicious actions.
This rule detects the creation of script files (batch, VBS, JS, PowerShell, or shortcut files) within Windows Startup folders. It monitors both user-specific and all-users startup locations. The primary purpose is to identify persistence mechanisms where an attacker or malicious software places a script to execute automatically when the system or user logs on.
Page 4 of 9