Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,911 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
Detects DNS requests to major generative AI and Large Language Model API endpoints (such as OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, and others) initiated by processes other than standard web browsers (e.g., chrome, msedge, firefox, safari). This behavior may indicate unauthorized data exfiltration, shadow AI usage, or automated tooling/scripts interacting with LLM APIs.
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects potential Multi-Factor Authentication (MFA) fatigue or push bombing attacks against Azure Active Directory (Entra ID) accounts by identifying a high volume of MFA failures followed by suspicious or fraudulent report actions, or successful authentications shortly after repeated failures.
Detects when a web browser (such as Chrome, Edge, Firefox, Internet Explorer, Brave, or Opera) spawns common command interpreters, scripting engines, or Living off the Land Binaries (LOLBins) like cmd, powershell, mshta, rundll32, or certutil. This behavior is often indicative of a drive-by compromise or browser exploitation attempt.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
This rule detects suspicious driver loading from user-writable paths, kernel driver service creation, disabling of driver signing, loading of Linux kernel modules, and the usage of LD_PRELOAD for rootkit functionality.
Detects potential cloud storage object discovery activity in Azure Blob Storage by identifying anomalous listing or enumeration operations from callers, including high request counts, extensive container access, high failure rates, or anonymous authentication.
Page 1 of 13