Vidhi Patel
@V1d0 followers0 downloads41 copies0 likes375 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
2
2
2
2
2
Platforms
4
1
Products / Services
4
1
MITRE Techniques
3
3
2
2
2
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
Detects suspicious process execution chains involving 'regsvr32.exe' followed by 'mshta.exe', 'powershell.exe', or 'rundll32.exe', especially when 'regsvr32.exe' is launched from common user download or application data directories. This pattern is often indicative of malware execution or living-off-the-land techniques.