Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects execution of pythonw.exe (windowless Python) from user-writable directories (e.g., AppData, Temp, Downloads) when launched by common parent processes typically associated with initial access or execution, indicative of the SynkLoader C2 malware.
Detects the execution of VBS scripts (wscript.exe or cscript.exe) that interact with the Windows Startup folder to create shortcuts. This behavior is associated with persistence mechanisms where malicious scripts create masqueraded shortcuts (e.g., SecurityHealth, OneDriveUpdate) in the user's Startup folder, often using hidden attributes to evade detection.
Microsoft Graph API Calendar C2 Activity
Cortex XDR
Detects anomalous Microsoft Graph API activity targeting calendar events and attachments, indicative of the HOLLOWGRAPH C2 protocol. The rule identifies application identity accounts using non-browser user agents to perform suspicious operations (e.g., creating events with future-dated timestamps, specific subject tag formats like 'Boss{..}ID{..}' or 'Event ID:', and file attachments named 'File{n}.txt'). This pattern suggests the use of a compromised M365 mailbox as a two-way dead-drop for C2 and data exfiltration.
Detects the enablement of the Remote Desktop Protocol (RDP) by modifying registry keys or service configurations, specifically when triggered by identified remote access tools or common script interpreters (cmd, powershell, etc.) executing from non-standard user-writable paths such as Temp or AppData. This behavior is indicative of lateral movement preparation.
Detects persistence and configuration activity associated with the CornFlake RAT, including the creation of malicious Windows services (e.g., 'svchost32', 'Cloud Sync Service'), registry run key modifications, and the presence of specific file artifacts like 'sync.dat' and malicious executables within AppData directories.
High-Entropy Subdomain AAAA Queries
Cortex XDR
Detects DNS queries using IPv6 (AAAA) records that contain high-entropy, long subdomain strings, which are indicative of DNS tunneling techniques. The rule specifically targets patterns similar to the HOLLOWGRAPH malware, which encodes data within subdomain labels to facilitate C2 communication.
Detects successful authentication events to the Okta Admin Console originating from known proxy services, anonymization networks, or suspicious infrastructure. This activity may indicate an attempt to use compromised administrative credentials to gain unauthorized access to the Identity Provider (IdP) for downstream reconnaissance or persistence.
Detects the creation of Windows Registry Run keys that masquerade as legitimate Realtek or WinAudio services. These keys point to executables located in user-writable paths such as AppData, Roaming, or Temp, a technique commonly associated with persistence mechanisms for malware like the Chaos ransomware.
Okta Administrative Privilege Grant
Cortex XDR
Detects administrative privilege grants to users or groups within Okta, including standard privilege grants and custom admin role bindings. This activity is often associated with account takeovers where an attacker attempts to escalate privileges or configure rogue IdP federation to maintain persistent access.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
Page 7 of 24