Rudra Verma
@RudravermaTrusted contributorCompletionist
3 followers269 downloads1,191 copies16 likes20,760 views
108 detections
Filters
Last updated
All Time
Detection languages
108
Categories
27
21
20
16
14
Platforms
61
39
9
7
6
Products / Services
34
18
17
15
4
MITRE Techniques
41
38
36
28
24
CVEs
2
2
1
1
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of New Zealand and Australia, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common system services. The rule aims to identify potential unauthorized access attempts or compromised accounts leveraging unusual client software or scripts.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
This rule detects the connection of USB network interface cards (NICs) that are known to be used in Man-in-the-Middle (MITM) implants or other malicious hardware additions. It specifically looks for devices with Vendor IDs and Product IDs associated with suspicious chipsets like ASIX AX88772A (Hak5 LAN Turtle), ASIX AX88179, Realtek USB GbE (Pi-based dongles/implants), Realtek 10/100 USB Ethernet, and D-Link USB Ethernet (modded implants).
This rule detects suspicious resource access patterns in Azure. Specifically, it flags instances where an 'Account' type actor (identified by a username) accesses resources that are not explicitly allowed for security monitoring (SecMon) or security orchestration, automation, and response (SecSoar) purposes. The rule also filters out activities from 'Microsoft-WindowsAzure-Frontdoor' and specific 'Microsoft.Resources' actions to reduce false positives. The primary goal is to identify unauthorized or unusual access to Azure resources by user accounts that fall outside defined security operational scopes.
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious external communication within Microsoft Teams.
This rule detects the connection of suspicious USB Network Interface Controllers (NICs) that are commonly associated with Man-in-the-Middle (MITM) implants or other malicious hardware additions. It identifies specific Vendor IDs and Product IDs known to be used in devices like Hak5 LAN Turtle, ASIX AX88179, Realtek USB GbE (often found in Raspberry Pi-based implants), and D-Link USB Ethernet devices that have been observed in modded implants. The rule specifically filters for PnpDeviceConnected events related to network adapters.
This rule detects the execution of Microsoft HTML Applications (HTA) files via mshta.exe, specifically when initiated by explorer.exe and the command line contains a reference to an .hta file. This behavior is often abused by adversaries to execute malicious scripts or payloads.
This rule detects instances of 'Code.exe' (the executable for Visual Studio Code) running from non-standard or suspicious file system locations. It specifically flags processes originating from temporary directories (like \Temp or \AppData\Local\Temp), the ScreenConnect Client directory, or Program Files (x86) which are not typical installation paths for VS Code. The rule aims to identify potential masquerading or execution of malicious code disguised as VS Code.
This rule detects the creation of the PsExec service (PSEXESVC, psexesvc, svcsvc, spoolsrv) or the execution of psexec.exe. PsExec is a legitimate Microsoft tool that allows administrators to execute processes on remote systems, but it is frequently abused by attackers for lateral movement and remote execution.
This rule detects the installation or execution of ScreenConnect client software. It looks for specific keywords in the process command line, folder paths, or file names associated with ScreenConnect. The rule also attempts to categorize the risk level based on the installation path, flagging installations in temporary directories or downloads as 'High Risk'.
Page 10 of 11