Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Detects scheduled tasks configured to run as SYSTEM executing suspicious binaries or commands, often used for privilege escalation and defense evasion.
Detects HTTP C2 beaconing patterns based on burst request counts with small response bodies (1-499 bytes). This rule correlates multiple HTTP requests to the same destination within a short timespan, where each response has a small body size. This pattern is indicative of command and control (C2) communication.
Detects command interpreters (cmd.exe, powershell.exe) launching fodhelper.exe, an indicator of an UAC bypass attempt.
Detects Windows executable downloads with document or image file extensions, a common malware delivery technique
Detects PowerShell scripts using Windows API calls for parent process ID spoofing, enabling malicious processes to masquerade as legitimate system processes.
Detects DNS queries to domains using common AWS typosquatting patterns such as 'awscloud', 'compute-aws', or billing/security lures.
Detects scheduled task creation configured to execute WindowsSandbox.exe, often used to evade EDR by running malware in an isolated container.
Detects cmd.exe executing VS Code server components with named pipe usage, indicating VS Code remote server or tunnel activity that may be used for legitimate development or malicious C2 channels
Detects VS Code CLI (code.exe) executed with the --without-connection-token parameter, which disables authentication for remote tunnel access.
Page 7 of 9