Thomas Carr
@TomcatUKCompletionist
12 followers69 downloads263 copies53 likes2,491 views
18 detections
Filters
Last updated
All Time
Detection languages
18
Categories
6
5
5
3
2
Platforms
14
2
1
Products / Services
9
2
2
1
1
MITRE Techniques
7
4
4
3
2
CVEs
1
Detects delivered emails where the subject line matches a specific pattern (five digits followed by a hyphen and text) and the attachment filename corresponds to the extracted subject text, ending with 'Document.xlsx', and the email was not quarantined post-delivery.
This detection looks for adversaries impersonating IT support or helpdesk via a Teams message.
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
This rule monitors the Windows Registry 'RunMRU' key for entries that include command execution patterns such as 'cmd.exe' or '%COMSPEC%' combined with suspicious arguments like 'finger' or 'cmd /c'. The RunMRU key stores the history of commands entered into the Windows 'Run' dialog, and this detection identifies potentially malicious command execution patterns often associated with malware loaders attempting to run secondary payloads or obfuscated commands via the shell history.
This rule detects suspicious process execution where PowerShell (powershell.exe) spawns a Python interpreter (python.exe or pythonw.exe) located in an AppData\Roaming directory. It specifically flags instances where the command line of the invoked process includes both a reference to the AppData\Roaming directory and a Python script (.py) file, which is a common behavior for loaders like CastleLoader attempting to execute scripts from user-writable directories.
This rule detects the execution of command-line interpreters (cmd.exe or powershell.exe) by either the w3wp.exe process (IIS worker process) or the wsusservice.exe process (Windows Server Update Services). This behavior can indicate a compromise, potentially leveraging vulnerabilities in web applications or WSUS to achieve remote code execution.
This rule detects network connections initiated by a process with a command line containing "filesystem", "--json", and "--results=verified", which is used to scan the entire filesystem.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
This rule detects the creation of an executable file (.exe) that is being extracted by an archive where the command line includes 'tar -xzf' and a '.tar.gz' archive.
This detects looks for the creation of scheduled tasks where the task content explicitly references a temporary file within the user's AppData\Local\Temp directory. This activity has been observed by AgentTesla as persistence mechanisms attempting to execute from a temporary location.
Detects PowerShell commands that use Get-WmiObject to query Win32_Process, specifically looking for process names. This can be indicative of discovery or reconnaissance activities using WMI.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
Page 1 of 2