Martin Baran
@MartinbaranCompletionist
1 follower40 downloads53 copies33 likes934 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
3
2
2
2
2
Platforms
7
Products / Services
4
1
1
MITRE Techniques
5
5
3
3
3
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
This detection identifies potential phishing or staging activity where Microsoft Outlook creates an SVG file, followed shortly by a web browser downloading a ZIP archive. The correlation between Outlook-based SVG creation and a browser-initiated ZIP download within one minute may indicate an attacker-controlled workflow for delivering additional payloads.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
KQL query designed to detect executables that invoke the Ollama interface (or other LLM-related activity) while simultaneously monitoring for the creation of potentially malicious script files. The detection specifically correlates suspicious process execution with the creation of .lua, .bat, and .ps1 scripts to broaden coverage and reduce false negatives.
KQL Query designed to detected tactics employed during active exploitation of WinRAR Zero-Day ( CVE-2025-8088)
KQL Query from file: Malicious NPM Package post install script
KQL Query
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query