Rudra Verma
@RudravermaTrusted contributorCompletionist
3 followers269 downloads1,191 copies16 likes20,760 views
108 detections
Filters
Last updated
All Time
Detection languages
108
Categories
27
21
20
16
14
Platforms
61
39
9
7
6
Products / Services
34
18
17
15
4
MITRE Techniques
41
38
36
28
24
CVEs
2
2
1
1
Detects browser processes making direct network connections to known Large Language Model (LLM) API endpoints. This activity is unusual when originating from general user web browsing, as it may indicate a malicious website is using an LLM to dynamically generate and fetch malicious code (e.g., JavaScript for a phishing page) at runtime.
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
Detects a browser visiting a URL with phishing-related keywords, followed by a direct network connection to a known Large Language Model (LLM) API endpoint from the same device within a short time window. This correlated behavior is a strong indicator of the "runtime assembly" attack pattern, where a malicious page dynamically generates a phishing payload by calling an LLM service.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of Australia and New Zealand, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common tools.
Detects the creation of a symbolic link or junction point by a non-elevated process where the target is a critical system file or directory. This is a key step in exploits like CVE-2025-0921, where a privileged process is tricked into writing to a sensitive location by following a malicious link.
This rule detects unexpected modifications to Notepad++ updater settings in the Windows Registry. Specifically, it looks for instances where the 'updater' registry value under 'Notepad++\Settings' is set to '1' or 'true', indicating that automatic updates are enabled or forced. This could be an indicator of compromise if Notepad++ is not expected to update automatically or if the modification occurs outside of normal update cycles, potentially by an attacker attempting to maintain persistence or introduce malicious updates.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
This rule detects configuration changes to Fortinet FortiGate firewall policies that occur outside of standard business hours (before 8 AM or after 5 PM NZDT). It specifically looks for actions like 'Move', 'Add', 'Enable', 'Delete', or 'Edit' on firewall policies. This can indicate unauthorized access or malicious activity, as legitimate changes are typically performed during business hours.
This rule detects network connections and DNS resolutions to a predefined list of known malicious IP addresses and domains. It also identifies HTTP requests containing specific URL paths ('update/update.exe', '/users/admin', '/api/') when made to these malicious IPs. This behavior is indicative of potential command and control (C2) communication or malware attempting to download updates or exfiltrate data.
Detects modification of critical ICONICS Suite configuration files by unauthorized processes. Attackers can modify these files, such as changing the SMSLogFile path in IcoSetup64.ini, to redirect privileged file writes for privilege escalation or DoS, as seen in the CVE-2025-0921 exploit chain.
Page 9 of 11