JP Williams
@SiriusCyberntxCompletionist
0 followers0 downloads229 copies1 like4,423 views
7 detections
Filters
Last updated
All Time
Detection languages
7
Platforms
7
7
2
Products / Services
5
1
MITRE Techniques
4
3
2
2
2
Detects inbound email delivered from external Microsoft 365 tenants (@*.onmicrosoft.com) which may be attempting to impersonate legitimate senders. Threat actors register disposable or lookalike M365 tenants to abuse Microsoft's native SPF/DKIM authentication and bypass email security controls.
Detects installation or update of a VSCode extension from an unapproved publisher by monitoring for vsce-sign.exe signature verification events in DeviceProcessEvents. VSCode invokes vsce-sign.exe once per extension install or auto-update to verify the extension's marketplace signature before extraction. The full extension slug is passed as the --package argument, making this a reliable, install-time signal that fires for all extension types regardless of whether the extension has a background process or language server.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Detects signed executable files with untrusted certificates (expired, revoked,
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
Detects LOLBins (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, etc.) spawned
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
Detects inbound network connections and Azure AD sign-in attempts originating from the 21-IP RDP scanning fleet attributed to AS213438 (ColocaTel Inc., Seychelles), as reported by GreyNoise on April 10, 2026. The fleet generated 67.4% of global RDP Crawler activity on April 7, 2026 across four /24 blocks geolocated to the Netherlands. The same ASN demonstrated a burst-and-crash pattern in both March and April 2026, suggesting further rotations are likely.
Detects network activity consistent with a user attempting to download or install OpenClaw or a known variant — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for access to OpenClaw distribution URLs including GitHub releases, the install script endpoint, raw GitHub content, and npm registry paths for known variants. Also detects variant names appearing in process command lines at the time of a network connection, covering alternative package managers and runtimes such as Bun, pnpm, Yarn, and Deno in addition to traditional browsers and shell tools. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.