Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects malware masquerading as the 'init' process to evade detection. This rule specifically looks for processes named 'init' that do not have an instance ID of '1' and are not located in the standard '/sbin/init' or '/usr/lib/systemd/systemd' paths. It also flags processes in suspicious temporary directories.
Detects COLDDRIVER malware loading specific malicious DLLs (machinerie.dll, checkme.dll, iamnotarobot.dll) via rundll32.exe, or the loading of specific malicious DLLs identified by their SHA256 hashes.
PHALT BLYX Startup URL Persistence
Cortex XDR
Detects the creation of .url files in the Windows Startup folder, which can be used for persistence. Specifically identifies a known IOC for PHALT BLYX malware ('DeleteApp.url') and flags other suspicious .url file creations in the Startup folder. This rule filters out common browser processes that might legitimately create .url files.
Azure Device Code OAuth Consent
Cortex XDR
This rule detects suspicious activity related to Microsoft 365 Device Code OAuth consent flows. It specifically looks for device code authentications that are single-factor or lack MFA, and then groups these by IP address and client application. The rule identifies suspicious patterns such as a high number of logins, unique users, or unique applications from a single IP address, or rapid login attempts within a short timeframe, which could indicate enumeration or phishing attempts.
This rule detects Amazon S3 PutObject events where server-side encryption is performed using SSE-C (Server-Side Encryption with Customer-Provided Keys) or where the request uses Signature Version 2 (SigV2). SSE-C relies on the customer to manage encryption keys, which can introduce risks if not handled securely. SigV2 is an older, less secure authentication protocol for AWS requests and its use is generally discouraged in favor of SigV4.
This rule detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value to '1' under a key containing 'WDigest'. The detection specifically looks for this modification being performed by a process whose image name matches a custom batch file pattern (e.g., ending with '!light*.bat'). This activity is associated with Qilin ransomware, which has been observed using this technique for credential access.
Detects modifications to critical registry settings that weaken security controls related to NTLM authentication, Restricted Admin mode, and RDP security. The rule specifically looks for disabling NTLM traffic restrictions (RestrictSendingNTLMTraffic set to 0), disabling Restricted Admin mode (DisableRestrictedAdmin set to 0), or weakening RDP security by setting the SecurityLayer to '1'. An alert is generated if two or more such modifications occur within a 7-day timeframe.
Timestomping Detection
Cortex XDR
This rule detects potential timestomping activity by identifying files where the creation time is later than the modification time. This behavior can indicate an adversary attempting to manipulate file timestamps to evade detection or forensic analysis. The rule specifically targets executable and script file extensions.
Detects attempts to tamper with AWS CloudTrail or GuardDuty logging configurations by monitoring specific API calls that can disable, modify, or delete logging mechanisms. This includes actions like stopping logging, deleting trails, updating trails, disassociating from master accounts, archiving findings, stopping member monitoring, and deleting or updating detectors. Successful execution of these actions without an error indicates potential malicious activity aimed at evading detection.
This rule detects the execution of 'rundll32.exe' with suspicious DLL names in the command line, specifically 'machinerie.dll', 'checkme.dll', or 'iamnotarobot.dll'. Additionally, it identifies the loading of specific malicious DLLs by their SHA256 hashes, which have been associated with ColdRiver (Star Blizzard) activity. This behavior is indicative of potential malware execution or persistence mechanisms.
Page 23 of 24