Rudra Verma
@RudravermaTrusted contributorCompletionist
3 followers269 downloads1,191 copies16 likes20,760 views
108 detections
Filters
Last updated
All Time
Detection languages
108
Categories
27
21
20
16
14
Platforms
61
39
9
7
6
Products / Services
34
18
17
15
4
MITRE Techniques
41
38
36
28
24
CVEs
2
2
1
1
This rule detects the execution or referencing of files named 'moonrise-client.exe', 'moonrise.exe', or 'moonriseclient.exe'. These filenames are associated with the Moonrise RAT, indicating potential malware activity on the system. The rule specifically looks for these filenames in the process's file name or command line arguments.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicating the use of Base64 encoded commands. Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by signature-based methods and to evade basic command-line logging. This detection specifically looks for the '-EncodedCommand', '-enc', or '-ec' flags (and their variations in casing) which are used to execute Base64 encoded strings as PowerShell commands.
This rule detects the execution of processes whose SHA256 hash matches a known hash associated with the MOONRISE RAT malware. It queries DeviceProcessEvents for the last 24 hours and filters for processes with matching SHA256 hashes.
This rule detects suspicious activity where an 'unfamiliar sign-in properties' alert occurs shortly after an administrator has changed a user's Multi-Factor Authentication (MFA) method. It correlates security alerts for unfamiliar sign-ins with audit logs indicating MFA method changes for the same user within a short timeframe. The rule then checks if the user's sign-in activity shows multiple IP addresses or locations, indicating a potential compromise or MFA bypass after the change.
This rule detects outbound network connections from devices to a known Moonrise C2 IP address (193.23.199.88). It specifically looks for successful connections, inbound connections accepted, or connection attempts to this malicious IP.
This rule detects modifications to properties of 'break glass' accounts. It joins a watchlist of identity categories containing 'Break Glass' accounts with Azure Audit Logs to identify specific operations performed on these accounts. The rule focuses on changes to user principal names, operation names, activity display names, results, and AAD operation types.
This rule detects sign-in attempts by 'Break Glass' accounts. Break Glass accounts are emergency access accounts typically used in situations where normal administrative access methods are unavailable. Monitoring their usage is critical due to the high privileges usually associated with these accounts. The rule joins sign-in logs with a watchlist of identities to specifically identify activity related to these designated accounts.
This rule detects when a guest user from a common public email domain (e.g., gmail.com, outlook.com) is invited to an Azure Active Directory (AAD) tenant and subsequently added to an AAD security group. This could indicate an attempt to grant unauthorized access to an external account or a misconfiguration allowing guest users to be added to sensitive groups.
This rule detects when an external user is invited to Azure Active Directory (AAD) from a common, publicly available email domain (e.g., gmail.com, outlook.com, yahoo.com). This can be an indicator of an attacker attempting to establish persistence or gain initial access by inviting an external account they control, or it could be a legitimate business process for collaboration with external parties using personal email addresses.
This rule detects outbound network connections to known command and control (C2) infrastructure. Specifically, it looks for connections to suspicious URLs (meeting.bulletmailer.net, clawdbot.getintwopc.site, darkgptprivate.com, getintwopc.site) or specific IP addresses (179.43.176.32, 178.16.54.253), or connections on a specific port (8041) which has been associated with ScreenConnect C2. The rule also attempts to identify the specific threat indicator based on the matched URL, IP, or port.
Page 7 of 11