Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,913 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
Detects the execution of various command-line tools (sc, net, powershell, wmic, taskkill, systemctl, launchctl) used to stop or disable system services. This behavior is often associated with adversaries attempting to stop security services, backup agents, or other critical infrastructure for impact, defense evasion, or prior to data destruction.
Detects when a non-system application on an Android device is granted Accessibility Service permissions or Notification Listener access. Malicious actors frequently abuse these permissions to perform overlay attacks, keylogging, or intercepting sensitive information such as 2FA codes.
Suspicious Discovery Command Execution
Cortex XDR
Detects the execution of common command-line utilities frequently used by adversaries for system, network, and account discovery after gaining initial access to a host.
Detects the parsing of Mach-O headers for files with specific, potentially anomalous extensions. This is often used to identify masqueraded executables, unsigned binaries, or files with suspicious RPath configurations that may indicate malicious activity.
Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.
This rule detects the execution of QuickAssist.exe or RemSupp.exe on a host where Microsoft Teams has also been executed within the last day. This pattern may indicate the use of built-in remote support tools in conjunction with communication platforms, potentially for unauthorized remote access or suspicious remote assistance activities.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
Detects the creation and subsequent execution of AppleScript files (.scpt) using the 'osascript' command-line utility on macOS. This pattern is commonly used to automate tasks, but can be leveraged by attackers for malicious payload execution or system interaction.
Cortex XDR Process Lineage Observation
Cortex XDR
This rule monitors and retrieves process lineage information, including child process execution, parent process context, and grandparent process hierarchy for a specific host. It extracts process execution details such as image names and command lines to provide visibility into process trees for forensic investigation and behavior analysis.
Detects the execution of an 'update.exe' process initiated by 'svchost.exe' where the update executable resides in non-standard, user-writable directories (AppData, Temp, Users Public, or Downloads). This behavior is highly suspicious as svchost.exe should typically only execute binaries from system directories, and the target file is running in a location common for malware staging.
Page 10 of 13