Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,913 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
Detects the execution of sequences of built-in administrative command-line tools often used by adversaries for system discovery and reconnaissance. The rule triggers on specific patterns of commands (e.g., WMI queries, system information gathering, or comprehensive user enumeration) that are frequently combined by attackers to understand the target environment.
This rule detects non-interactive sign-in events involving the 'Microsoft Authentication Broker' where the authentication was performed using only single-factor authentication and originated from a device that is not recognized or lacks trust information (unmanaged/unknown device). This pattern is consistent with token replay attacks or session hijacking, where an adversary uses stolen authentication artifacts to access resources without undergoing standard multi-factor authentication.
This rule detects scenarios where an email containing a specific URL has been soft or hard deleted from a user's mailbox (often by security automated systems), but a user has subsequently clicked that same URL. This often indicates a race condition or a failure in security controls where a malicious link was delivered and accessed before or during the removal process.
This rule monitors the Microsoft 365 AuditLogs to retrieve and investigate all actions taken by or against a specific user account. It expands the TargetResources field to extract the TargetUPN and filters for a specific account, providing a timeline of operations, the actor who initiated the action, and the result of the operation.
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
This rule monitors email traffic by aggregating data from email events, attachment information, and URL click interactions. It identifies emails that contain attachments and correlates them with specific file attributes (name, extension, hash, threat type) and any subsequent user interaction with URLs contained within those emails, including blocked or allowed clicks.
This KQL rule queries the IdentityInfo table to retrieve the most recent identity, risk, and criticality profile for a specific user account. It maps raw criticality data into a human-readable format and extracts key identity attributes such as department, job title, and assigned roles.
This rule serves as an investigation framework for Microsoft Entra ID sign-in events. It enables security analysts to filter, normalize, and inspect user authentication activities, including sign-in types (interactive/non-interactive), device management status, user risk levels, and conditional access status. The query is designed for incident response and forensic analysis rather than automated alerting.
Frequent Registry Modification Activity
Cortex XDR
This rule identifies processes performing a high volume of registry modifications by tracking unique registry key and value sets associated with user and process context. This behavioral pattern is often used to detect persistence mechanisms, configuration changes, or mass registry manipulation.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
Page 12 of 13