Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Azure Blob Storage Account Key Access
Cortex XDR
Detects successful access to Azure Blob Storage using storage account keys (key1 or key2). This activity is often indicative of an adversary using compromised credentials to access cloud storage resources.
Azure Blob SAS Access
Cortex XDR
Detects access to Azure Blob Storage using Shared Access Signature (SAS) authentication. This rule specifically looks for successful blob operations where the authentication type is SAS and the identity name matches 'key1' or 'key2', which are often associated with storage account access keys used to generate SAS tokens. Monitoring such access can help identify unauthorized or suspicious use of SAS tokens.
Detects trojanized VPN processes spawning suspicious child processes (like rundll32, regsvr32, mshta, wscript, powershell, cmd) or writing RunOnce persistence in the registry, or loading malicious DLLs (dwmapi.dll, inspector.dll). The detection specifically targets processes signed by "Taiyuan Lihua Near Information Technology", which has been associated with Storm-2561 activity.
Storm-2561 Network IOC Detection
Cortex XDR
Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.
Storm-2561 Malicious File Hash Detection
Cortex XDR
This rule detects the presence of malicious files associated with the Storm-2561 threat actor by matching their SHA-256 hashes. The rule specifically targets files on Windows operating systems and also filters for files signed by "Taiyuan Lihua Near Information Technology Co., Ltd.", which is known to be associated with these malicious activities. The detected files include ZIP archives, MSI installers, DLLs, and fake VPN executables.
Detects when a new federation identity provider (SAML or OpenID Connect) is created or updated in AWS Identity and Access Management (IAM). This could indicate an attempt to establish new trust relationships for federated access.
This rule detects the launch of Amazon EC2 instances with GPU-enabled or very large instance types. Adversaries may launch such instances for resource-intensive tasks like cryptocurrency mining or other compute-heavy operations, which can lead to unexpected cloud costs and resource hijacking.
AWS Console Brute Force Activity
Cortex XDR
Detects repeated failed AWS console login attempts from the same IP address within a one-hour window, indicating a potential brute-force attack against AWS accounts.
This rule detects the creation of Amazon SNS (Simple Notification Service) subscriptions that are configured to send notifications to external HTTP or HTTPS endpoints. It specifically looks for `Subscribe` events from the `sns.amazonaws.com` service where the `protocol` is either `http` or `https` and the `endpoint` does not belong to Amazon's own domains (amazon.com, awsapps.com, amazonaws.com). This could indicate data exfiltration or misconfiguration where sensitive information might be sent to an unapproved external service.
AWS SES Email Enumeration Detection
Cortex XDR
Detects enumeration of AWS SES email identities and sending quotas. This activity can indicate an attacker performing reconnaissance before launching phishing or Business Email Compromise (BEC) attacks. The rule identifies multiple distinct SES operations related to identity and quota checks performed by a single user within a two-hour window.
Page 19 of 24