Daniel Koifman
@KoifsecTrusted contributorCompletionist
4 followers237 downloads206 copies5 likes48,125 views
51 detections
Filters
Last updated
All Time
Detection languages
17
16
9
6
3
Categories
20
6
3
3
2
Platforms
34
1
1
Products / Services
16
3
MITRE Techniques
7
5
5
4
4
This rule detects attempts to delete shadow copies using built-in Windows utilities such as PowerShell, WMIC, or VSSAdmin. The detection specifically looks for command-line arguments containing 'shadow' and 'delete' when executed by these processes. This activity is commonly associated with ransomware or other destructive malware aiming to prevent system recovery.
This rule detects the execution of executables with single-character filenames on Windows systems. Such filenames can be used by adversaries to obfuscate malicious activity, making it harder for users and security tools to identify the true nature of a file. This technique is often employed in malvertising campaigns or other forms of social engineering to trick users into executing seemingly benign files.
This rule detects potential abuse of Microsoft Excel where a process other than Excel itself is launched by Excel. This behavior can be indicative of malicious Excel add-ins (XLLs) or macros executing external code, a common technique used in phishing campaigns and malware delivery. The rule specifically looks for `excel.exe` as the parent process and a different executable (`ImageFileName`) as the child process.
This rule detects the execution of 'DlpUserAgent.exe' from an unusual path, specifically excluding the Windows Defender directory. This executable is often associated with Data Loss Prevention (DLP) software, but its execution outside of expected system directories can indicate potential DLL side-loading or other forms of execution hijacking. The rule looks for process creation events where the image file name or original file name matches 'DlpUserAgent.exe' and the path is not within the Windows Defender directory.
This rule detects the execution or presence of files related to the Xeox Remote Monitoring and Management (RMM) tool. It specifically looks for process creation events where the image file name, original file name, or parent base file name contains 'xeox_' or 'xeox-', or where the image file path includes '\xeox\'. This helps identify the initial execution or persistence mechanisms of the Xeox RMM.
This rule detects PowerShell processes executing commands that involve reading bytes from a .lnk file. This behavior is often associated with malware attempting to extract malicious content embedded within a shortcut file, potentially for further execution or to bypass security controls. The rule specifically looks for `powershell.exe` or `pwsh.exe` in the image filename or original filename, combined with command-line arguments containing both `.lnk` and `readallbytes`.
This rule detects the execution of processes associated with Pulseway RMM (Remote Monitoring and Management) software. It specifically looks for process image file names, original filenames, or parent base filenames containing 'PCMonitorManager.exe' or 'pcmonitorsrv.exe'. These executables are known components of the Pulseway RMM agent. Detection of these processes can indicate the presence of legitimate RMM software, or potentially unauthorized remote access if not sanctioned by the organization.
This rule detects the execution of 'ADNotificationManager.exe' or a process with 'ADNotificationManager.exe' as its original filename. It specifically excludes processes where the image filename contains 'acrobat' or 'reader'. This pattern is often associated with DLL side-loading techniques, where a legitimate application (like ADNotificationManager.exe) is used to load a malicious DLL.
This rule detects when 'offreg.dll' is loaded by an application that is not located in common, legitimate Windows or program files directories. 'offreg.dll' is a legitimate Windows DLL related to offline registry manipulation. Its loading by unusual applications outside of expected system paths could indicate an attempt at DLL hijacking, persistence, or other malicious activity, as adversaries might use it to load their own malicious code or manipulate the registry. The rule explicitly excludes known legitimate paths to reduce false positives.
This rule detects PowerShell commands that are used to enumerate locale-related system information. Specifically, it looks for PowerShell or pwsh.exe processes executing commands containing keywords like 'InstalledUICulture', 'Get-UICulture', 'CurrentUICulture', 'CurrentThread.CurrentUICulture', 'DefaultThreadCurrentUICulture', 'OSLanguage', or 'MUILanguages'. This activity can be indicative of an adversary attempting to gather system configuration details, potentially for environmental awareness or to tailor subsequent actions.
Page 1 of 6