Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
This rule detects the execution of a process where the parent process is 'fodhelper.exe'. This behavior can be indicative of privilege escalation or UAC bypass techniques, as fodhelper.exe is a legitimate Windows binary that has been abused by adversaries to execute arbitrary commands with elevated privileges without triggering a UAC prompt. The rule specifically looks for Sysmon EventCode 1 (process creation) where the ParentImage field contains '*\fodhelper.exe'.
This rule detects the execution of 'fodhelper.exe' when its parent process is a common scripting or command-line interpreter. This behavior is often associated with UAC bypass techniques, where 'fodhelper.exe' is leveraged to execute arbitrary commands with elevated privileges without prompting the user. The rule specifically looks for 'fodhelper.exe' being launched by 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', or 'cscript.exe'.
This rule detects the creation and subsequent deletion of scheduled tasks on a Windows system within a one-hour window. It specifically looks for Sysmon EventCode 1 (process creation) where the image is 'schtasks.exe' and the command line contains both '/create' and '/delete' operations, along with '/S' (system name) and '/TN' (task name) parameters. It excludes operations targeting 'localhost', '127.0.0.1', or '::1'. The rule then counts the number of create and delete actions per computer and user within an hour, triggering an alert if both create and delete actions are observed.
Detects PowerShell execution where the window is hidden, combined with suspicious commands such as encoded payloads, direct execution of expressions (iex, Invoke-Expression), web requests (DownloadString, iwr, Invoke-WebRequest), base64 decoding (FromBase64String), or execution policy bypass. The rule specifically excludes legitimate application package management operations involving 'AppxPackage' and certain Visual Studio Code (VS Code) installer and process management activities.
This rule detects large outbound file transfers, specifically those exceeding 1MB per file, from an internal host to an external IP address, as tracked by Zeek's file logs. It serves as a baseline for volume aggregation. A correlated rule then aggregates these individual transfers, triggering an alert if the total volume of files transferred to a specific external IP from a specific internal host exceeds 15MB within a 10-minute window. This aggregation aims to detect exfiltration attempts where data might be split into smaller chunks to evade single-file size limits.
This rule detects a successful SSH login that occurs within 10 minutes after 10 or more failed SSH login attempts targeting the same user, regardless of the source IP address. This scenario is indicative of a brute-force attack where the attacker might be changing source IPs but consistently targeting a specific user account.
Detects PowerShell loading .NET assemblies into memory (not from disk) via reflection from suspicious sources including base64-encoded data, web downloads, or compressed streams. This pattern indicates fileless malware execution or post-exploitation tool delivery.
This rule identifies unusually short user sessions on Linux and Vyatta systems. It looks for instances where a user session is opened and then closed within 10 seconds. The rule then aggregates these short sessions over 5-minute intervals per host, counting the number of such sessions, listing affected users, and calculating the minimum, maximum, and average duration of these short sessions. This could indicate rapid login/logout activity, potential script-based access, or unusual system behavior.
The rule detects the deletion of specific registry keys associated with UAC bypass techniques. Specifically, it looks for deletions where the 'TargetObject' field contains the string '\ms-settings\Shell\Open\command'. This activity is indicative of anti-forensics, as an attacker might delete these keys to remove evidence of privilege escalation after performing a UAC bypass.
This rule detects the creation of scheduled tasks on remote systems using the 'schtasks.exe' utility. Specifically, it looks for instances where a scheduled task is created with high-privilege accounts such as 'Administrator', 'SYSTEM', or 'NT AUTHORITY'. The detection logic requires the presence of '/create', '/s' (specifying a remote system), '/tr' (task run), '/tn' (task name), and '/ru' (run as user) flags in the command line. It explicitly filters out tasks created on the local machine (localhost, 127.0.0.1, ::1). This activity is indicative of potential lateral movement or privilege escalation, as adversaries often use remote scheduled tasks to establish persistence or execute commands on other systems within a network with elevated privileges.
Page 5 of 9