Luis Zavier Guzman Garcia
@KillBillKill983 followers77 downloads115 copies8 likes3,615 views
16 detections
Filters
Last updated
All Time
Detection languages
16
Categories
5
5
3
3
3
Platforms
15
3
Products / Services
15
3
2
MITRE Techniques
9
7
6
5
5
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
This rule detects instances of 'WerFaultSecure.exe' being spawned by an unusual or unexpected parent process. 'WerFaultSecure.exe' is a legitimate Windows component responsible for error reporting and crash dumping. Adversaries may abuse this process, particularly for memory dumping (e.g., LSASS dumping) to evade defenses and escalate privileges. The rule identifies parent processes that are not part of a predefined list of legitimate parents (wermgr.exe, svchost.exe, csrss.exe, WerFault.exe). It assigns a suspicion score and risk level based on the initiating process's filename (e.g., PowerShell, CMD, Explorer) and folder path (e.g., Temp, AppData, Users). It also extracts the target Process ID (PID) and dump type from the command line, and checks for suspicious parameters, to provide a comprehensive risk assessment.
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
KQL Query from file: Endpoint SMB Exposed on Public Internet
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
Detects the creation of Chrome extension files (.crx) that match known malicious extension IDs. Malicious CRX files on endpoints can indicate an attacker dropped or installed a malicious extension (e.g., credential harvesters, redirectors, miners). The rule flags CRX creation with known bad IDs and requires available file hashes for further investigation.
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
This rule detects network connections to known EvilGinx phishing infrastructure, identified by specific remote URLs, IP addresses, and a suspicious login URL pattern. EvilGinx is a phishing framework used for credential harvesting and session cookie theft, often employing adversary-in-the-middle techniques.
This rule detects network traffic blocked by Microsoft Defender Exploit Guard Network Protection or SmartScreen. It categorizes these detections into several types: Indicator of Compromise (IoC) URLs, Web Content Filtering, Malicious/Command & Control, and Cloud App Security Broker (CASB) policy violations. The rule summarizes these events per device, providing counts for each detection category and listing the blocked URLs with timestamps.
Page 1 of 2