LeMagicKonch
@LeMagicKonchCompletionist
0 followers4 downloads17 copies0 likes94 views
7 detections
Filters
Last updated
All Time
Detection languages
7
Categories
1
1
1
1
Platforms
1
MITRE Techniques
1
1
1
1
Displays commands that were executed with parent processes commonly associated with lateral movement. Will need tuning per environment.
Suspicious LSASS Process Access
Cortex XDR
Uses the Sysmon Event ID 10 to alert on process accesses of LSASS that are not normally seen within enterprise environments
Web Shell Hunting (w3wp Child Processes)
Cortex XDR
Helps analyze child processes of w3wp.exe.
Windows Defender Detection
Cortex XDR
Discovered while doing Adversary Emulation that Windows Defender will sometimes detect files/activity that Cortex fails to detect. In order to be alerted on these detections Cortex requires a custom correlation rule to be created and this is that.
Windows Defender Tampering
Cortex XDR
Detects Tampering with Windows Defender Settings
This rule detects suspicious process creation events where 'wsmprovhost.exe' (Windows Remote Management Provider Host) is the parent process. Wsmprovhost.exe is legitimately used for remote management via WinRM, but its child processes can indicate remote execution of commands or scripts, which is often abused by adversaries for lateral movement or execution.
Correlate XDR Data with Alert ID
Cortex XDR
This rule correlates an existing alert (identified by alert_id) with XDR data based on hostname and a narrow time window (500 milliseconds before and after the alert time). It aims to find XDR events that occurred on the same host around the time an alert was generated.