Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
Detects PowerShell processes using base64-encoded commands that establish outbound network connections within 5 minutes, indicating potential tool transfer or C2 activity. This rule correlates two base rules: one for base64-encoded PowerShell process creation and another for PowerShell network connections.
Detects PowerShell download cradles using Invoke-RestMethod or Invoke-WebRequest piped to Invoke-Expression for fileless malware execution.
Detects a ClickFix attack chain involving an email client opening a browser to a suspicious domain, followed by a file download, and subsequent execution via cmd.exe from explorer within a short timeframe. This chain of events is indicative of a social engineering attack designed to trick users into executing malicious files.
Detects processes with document file extensions spawning command shells (cmd.exe or powershell.exe), indicating malware execution
Detects cmd.exe spawning processes with document file extensions, indicating a PE binary masquerading as a document
Detects .wsb configuration files created in common staging directories used by attackers for malware deployment.
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Detects modification of ms-settings Shell\Open\command registry key used for UAC bypass via fodhelper.exe. This registry key should never be modified by legitimate software.
Detects PowerShell checking if the current user has Administrator privileges using .NET reflection.
Detects fodhelper.exe spawning unexpected child processes such as command shells or processes from user-writable directories. fodhelper.exe is abused for UAC bypass and should not spawn child processes under normal conditions.
Page 8 of 9