Rudra Verma
@RudravermaTrusted contributorCompletionist
3 followers269 downloads1,191 copies16 likes20,760 views
108 detections
Filters
Last updated
All Time
Detection languages
108
Categories
27
21
20
16
14
Platforms
61
39
9
7
6
Products / Services
34
18
17
15
4
MITRE Techniques
41
38
36
28
24
CVEs
2
2
1
1
Detects the execution of mshta.exe, specifically when initiated by explorer.exe and processing an HTA file. This behavior is often associated with malicious activity, as mshta.exe can be abused to execute arbitrary code.
This rule detects successful user sign-ins to Azure AD from IP addresses located outside of New Zealand and Australia, where the User-Agent string matches a known list of suspicious user agents. It filters out common legitimate user agents to reduce false positives.
This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.
This rule detects the connection of USB Network Interface Controllers (NICs) with specific Vendor and Product IDs known to be associated with suspicious devices often used in Man-in-the-Middle (MITM) implants. These include devices like the Hak5 LAN Turtle, Realtek USB GbE adapters (often found in Raspberry Pi-based implants), and D-Link USB Ethernet adapters that have been observed in modified implants. The rule specifically filters for 'PnpDeviceConnected' events where the device class is a network adapter.
Detects the installation of malicious Chrome extensions known to steal ChatGPT/DeepSeek conversations by looking for the creation of files in directories named with specific malicious extension IDs. This rule identifies file creation events within folders corresponding to known malicious Chrome extension IDs, indicating their installation on a device.
This rule detects network connections and DNS queries to command-and-control (C2) domains associated with malicious Chrome extensions. These extensions are known to steal sensitive data such as ChatGPT and DeepSeek conversations, as well as other browsing data. The rule specifically targets known malicious domains to identify C2 communication and potential data exfiltration.
Detects suspicious commands written to the Windows RunMRU registry key, which stores the history of commands executed via the Windows Run dialog (Win+R). This activity is often associated with the "ClickFix" social engineering technique, where users are tricked into pasting and running malicious commands. The rule identifies various suspicious indicators, including fake verification messages, PowerShell commands with obfuscation or download cradles, mshta, wscript, curl, wget, rundll32, bitsadmin, ssh proxy abuse, and obfuscated command line arguments.
This KQL detection will create an incident related to malicious .html execution on device
Page 11 of 11