Michael Fajkus
@MilesDysonCompletionist
4 followers117 downloads332 copies47 likes4,698 views
27 detections
Filters
Last updated
All Time
Detection languages
27
Categories
10
7
4
1
1
Platforms
23
8
5
2
1
Products / Services
23
18
1
1
1
MITRE Techniques
5
4
4
4
3
IDS Classtypes
1
Detects suspicious reuse of NTLM authentication hashes by the same user account across multiple hosts within a short time window. This behavior may indicate lateral movement techniques such as pass-the-hash attacks or credential replay.
Detects suspicious use of curl or wget on Linux systems to download content from external domains. The detection extracts target domains from the command line arguments and filters out known legitimate destinations (e.g., GitHub, Linux package mirrors).
Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring.
The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring.
The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
This detection identifies suspicious command-line activity (e.g. powershell, cmd.exe, wsl.exe, etc.) that is initiated via explorer.exe, suggesting potential user-initiated execution (e.g., copy-paste into Run dialog or file association abuse). This technique is commonly used in social engineering campaigns or malware execution patterns, and is associated with the campaign tag: fileFix.
This detection identifies emails containing links that use well-known URL shortening services (e.g., bit.ly, t.co, tinyurl.com). While these services are commonly used for legitimate purposes, they are frequently abused by threat actors to obfuscate malicious destinations. This detection joins EmailUrlInfo with EmailEvents to include sender metadata and filters out trusted senders based on a configurable watchlist (ShortenerSafeSenders).
Detects potential Unicode-based homograph attacks by scanning for non-ASCII characters in both DeviceNetworkEvents.RemoteUrl and EmailUrlInfo.Url. These attacks leverage visually deceptive domain names—using characters from non-Latin scripts (e.g., Cyrillic "а" instead of Latin "a")—to mimic legitimate sites and deceive users.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
This detection identifies instances where the diskshadow.exe utility is executed by a privileged user shortly after a successful logon. diskshadow.exe is a legitimate tool often abused by attackers for shadow copy manipulation and data exfiltration. Monitoring its use by privileged accounts helps identify potential malicious activity.
Page 3 of 3