Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
Detects Windows Sandbox launched by non-interactive accounts such as SYSTEM or service accounts, indicating automated malicious execution.
Detects code.exe file creation in non-standard locations such as user home directories or temp folders, indicating potential staging of VS Code CLI for malicious purposes
Detects Windows Sandbox execution with a .wsb configuration file, often used to automate malicious sandbox environments for defense evasion.
Detects deletion of ms-settings registry keys used for UAC bypass techniques, indicating anti-forensics activity to remove evidence of privilege escalation.
This detection identifies potential Golden Ticket attacks by correlating multiple Windows Security Event IDs that are indicative of forged Kerberos TGT usage. Specifically, it focuses on accounts requesting TGTs using uncommon or high-privilege encryption types (0x17, 0x18, 0x12), interacting with the krbtgt service, and logging in using elevated privileges and interactive logon types (4624, 4672). The rule filters out computer accounts and performs deduplication and correlation across a series of Kerberos-related activities, aiming to surface accounts that could be using forged Kerberos tickets for lateral movement or privilege escalation.
Detects potential DCSync attacks by correlating Active Directory replication requests (Event ID 4662) with suspicious network activity (Sysmon Event ID 3). DCSync allows attackers with replication privileges to request credential data from domain controllers, mimicking legitimate replication traffic.
Page 9 of 9