Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
Detects successful administrative logins ('vmanage-admin') to a Cisco SD-WAN device from an IP address not on the authorized list. This could indicate exploitation of CVE-2026-20127, an authentication bypass vulnerability.
Detects the execution of known Remote Monitoring and Management (RMM) tools or related lures from suspicious user-writable directories like Downloads or Temp folders. Adversaries trick users into downloading RMM tools into these locations to bypass typical software installation monitoring.
Detects when a Remote Monitoring and Management (RMM) tool or a known lure spawns 'msiexec.exe' to download and execute a remote installer. This behavior is often abused by threat actors to deploy secondary payloads like additional C2 tools, leveraging legitimate RMM functionality.
Detects when a known Remote Monitoring and Management (RMM) tool is used to install a secondary RMM tool. Threat actors use this technique to establish redundant and persistent access to victim networks.
Detects the creation or modification of the SimpleHelp RMM configuration file (serviceconfig.xml). Threat actors have been observed using SimpleHelp as part of a chained RMM attack, and this file contains the C2 server configuration.
This rule detects large volumes of outbound network traffic originating from Azure Kubernetes Service (AKS) clusters to external destinations over non-standard ports. It specifically looks for traffic allowed by Palo Alto firewalls, excluding common ports like 80 and 443, and flags transfers exceeding a defined data threshold (e.g., 100MB). This behavior can indicate data exfiltration attempts where adversaries use alternative protocols to bypass standard monitoring.
Detects Microsoft Office applications establishing outbound network connections to non-private, non-Microsoft IP addresses. This behavior can be indicative of exploitation of vulnerabilities like CVE-2026-21509, where an embedded OLE object or malicious macro attempts to download a payload or beacon out.
Detects attempts to access the sensitive Clawdbot/Moltbot configuration file (clawdbot.json or moltbot.json). This file contains API keys and gateway tokens. Unauthorized access, often resulting from prompt injection attacks, can lead to full agent and system compromise.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawning suspicious child processes like command shells or script interpreters. This behavior can be indicative of malicious macro execution or exploitation of vulnerabilities, where an embedded OLE object leads to code execution.
Detects inbound network connections from external (non-loopback, non-private) IP addresses to ports commonly used by Clawdbot/Moltbot gateways (3000, 8080, 16007). An exposed gateway is a significant security risk that can allow unauthorized remote administrative control over the AI agent.
Page 1 of 10