Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
Detects the deletion of scheduled tasks on remote systems shortly after their creation, indicating potential cleanup of lateral movement artifacts. This behavior is often observed when attackers create tasks for execution and then remove them to evade detection. The correlation groups events by user, meaning it can match operations performed by the same account across different target systems. This rule specifically looks for `schtasks.exe` being used with the `/create` and `/delete` commands targeting remote systems (excluding localhost, 127.0.0.1, and ::1) within a one-hour window.
This rule detects when 'explorer.exe' spawns PowerShell, and the PowerShell command line contains indicators of network communication for downloading content. Specifically, it looks for HTTP/HTTPS URLs or common PowerShell cmdlets and aliases used for web requests and file downloads (e.g., 'iwr', 'Invoke-WebRequest', 'wget', 'curl', 'DownloadString', 'DownloadFile', 'WebClient', 'Net.WebClient', 'BitsTransfer', 'Start-BitsTransfer', 'Invoke-RestMethod'). This behavior can indicate the execution of a download cradle, often used in initial access or command and control phases to retrieve additional malicious payloads.
Detects 5 or more quick SSH sessions from a single IP address within 5 minutes, indicating credential validation attacks, automated scanning, or brute-force attempts.
This rule detects the creation of scheduled tasks using the `schtasks.exe` utility with specific parameters indicating elevated privileges. Specifically, it looks for tasks created with the `/create` command, running under the `SYSTEM` user account (`/ru SYSTEM`), and with the highest privilege level (`/rl HIGHEST`). This combination of parameters is often leveraged by adversaries for defense evasion, persistence, and privilege escalation by ensuring the scheduled task executes with maximum system privileges.
The rule detects modifications to specific registry keys associated with UAC bypass techniques, particularly those leveraging fodhelper.exe. It monitors changes to the 'ms-settings\Shell\Open\command\(Default)' and 'ms-settings\Shell\Open\command\DelegateExecute' registry values. These modifications are indicative of an attempt to bypass User Account Control by hijacking the execution flow of a trusted process.
The rule detects instances where command interpreters such as cmd.exe, powershell.exe, pwsh.exe, wscript.exe, or cscript.exe launch fodhelper.exe. This specific parent-child process relationship is indicative of a potential User Account Control (UAC) bypass attempt. While legitimate administrative scripts might occasionally involve fodhelper.exe, this pattern is considered suspicious and warrants investigation due to its common use in privilege escalation techniques.
The rule detects the creation of tar archive files (including .tar, .tar.gz, .tgz, and .tar.bz2) within common user-writable directories on Windows systems. Specifically, it looks for these archive files being created in paths containing '\Downloads\', '\Temp\', '\Public\', '\Desktop\', '\AppData\Local\Temp\', or 'C:\ProgramData\'. This activity could indicate data staging for exfiltration, where an attacker collects and archives data before moving it out of the compromised system.
The rule detects the `fodhelper.exe` process spawning any child process. This activity is considered highly suspicious because `fodhelper.exe` does not typically spawn child processes during normal operation. Such behavior is indicative of a User Account Control (UAC) bypass exploitation attempt, specifically leveraging `fodhelper.exe`.
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
Detects registry values containing Base64-encoded PowerShell commands. Attackers use this technique to obfuscate malicious commands in the registry for persistence or execution.
Page 6 of 9