Shivam Malaviya
@Shviam0 followers69 downloads31 copies18 likes904 views
17 detections
Filters
Last updated
All Time
Detection languages
17
This detection identifies potential Golden Ticket attacks leveraging forged Kerberos TGTs for domain administrator access through suspicious logon patterns.
This detection identifies network connections to known Tor exit nodes using a CSV feed of Tor relay IP addresses, helping detect potential data exfiltration or command and control communications through Tor.
This detection identifies suspicious processes spawned from the Volume Shadow Copy Service (scpvss.exe), which attackers may exploit to delete backups or access sensitive files.
Alternative Tor detection using Azure Blob Storage providing redundancy and potentially more up-to-date Tor relay information. Valid rule.
This detection identifies the use of KrbRelayUp, exploiting Kerberos relay attacks for local privilege escalation to SYSTEM.
This query generates a report of devices eligible for Microsoft Defender for Endpoint onboarding, aiding in identifying gaps in endpoint protection. The rule is valid.
This detection identifies modifications to the AutoAdminLogon registry key, which can be exploited by attackers for persistence and to maintain access after system reboots.
This detection monitors Java JAR file execution, often used for malicious purposes, and flags unexpected activity for investigation.
This detection identifies connections to IP addresses associated with CVE-2022-26134, a critical remote code execution flaw in Atlassian Confluence.
This detection identifies connections to malicious IPs from the Feodo Tracker blocklist, tracking C2 servers for banking trojans like Emotet, Dridex, and TrickBot.
Page 1 of 2