Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,420 copies852 likes146,821 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
This rule detects potential phishing attempts targeting Docusign users. It identifies emails containing URLs or network connections to specific domains (page-docusign-[a-z0-9]+\.workers\.dev) which are commonly used in phishing campaigns to mimic legitimate Docusign login pages or related services. The use of 'workers.dev' subdomains often indicates malicious infrastructure.
This rule detects inbound emails containing a URL that initiates an OAuth 2.0 authorization flow for Microsoft Online, specifically looking for the 'prompt=none' parameter. This combination can be indicative of consent phishing attempts where an attacker tries to trick users into granting permissions to a malicious application without explicit interaction, often by pre-approving the prompt. The rule filters for inbound emails that were not blocked, suggesting they reached the user's inbox.
This rule detects emails containing URLs that initiate OAuth 2.0 authorization flows for Microsoft or Google, and where the URL contains a known malicious OAuth ID. This is indicative of an OAuth phishing attempt, where attackers try to trick users into granting access to malicious applications.
This rule detects network communication with known AI model providers by checking `RemoteUrl` against a list of AI API URLs from an external CSV file. It aims to identify potential unauthorized use of AI services, data exfiltration to AI models, or to monitor AI usage within an environment.
This rule detects the execution of a process that attempts to build an executable using 'zig build-exe' and subsequently initiates a process with a command line containing 'https://github.com/nullclaw/nullclaw.git'. This could indicate an adversary building a malicious executable on a host and then attempting to download or interact with a malicious GitHub repository, potentially for further stages of an attack.
This rule detects network connections to domains that appear to be dynamically generated IPv6 reverse DNS entries. These types of domains (e.g., 'xxxxxxxxxx.ip6.arpa') are often used in command and control (C2) communications or for exfiltration by malware to evade traditional domain-based detection. The regex specifically looks for a 10-character alphanumeric string followed by '.ip6.arpa'.
This rule detects the execution of a 'git clone' command to download the 'qwibitai/nanoclaw' repository, specifically on devices where a 'node' or 'node.exe' process associated with 'claude' is also observed. This could indicate an adversary installing tools or malicious code on a system potentially related to a 'claude' application or service.
This rule detects the creation of a registry key named 'MonitoringService' under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. This registry key is commonly used by adversaries to establish persistence, ensuring that a malicious program or script executes automatically each time a user logs on to the system.
This rule detects the execution of `nslookup` and `findstr` together in a command line, specifically looking for non-private IP addresses. This combination can indicate an adversary attempting to discover remote systems or exfiltrate data by encoding it within DNS queries, often seen in DNS tunneling or data staging activities.
https://www.bleepingcomputer.com/news/security/new-clickfix-attack-abuses-nslookup-to-retrieve-powershell-payload-via-dns/
Page 12 of 55