Ranger007 _
@Ranger0070 followers14 downloads74 copies3 likes707 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
1
1
Platforms
2
1
Products / Services
2
1
MITRE Techniques
2
2
2
1
1
This detection identifies network connections to known first-stage Microsoft 365 phishing domains associated with an active Adversary-in-the-Middle (AiTM) campaign.
This rule detects a suspicious activity chain where an SVG file is created by Outlook, immediately followed by a browser downloading a potentially malicious payload (archive, executable, or script file) on the same device within a short timeframe. This pattern could indicate a social engineering attack where a user is tricked into opening a malicious SVG attachment, which then leads to the download of a secondary malicious file.
Detects the execution of command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe) from the Netlogon or Sysvol shares. This activity is highly suspicious as these shares are typically used for Group Policy and logon scripts, not for direct execution of interactive shells or scripting engines by users or processes. This could indicate an adversary attempting to execute malicious code or scripts from a central, often replicated, location within a Windows domain environment, potentially for lateral movement, persistence, or privilege escalation.