Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,912 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
Detects the first-seen external Remote Desktop Protocol (RDP) logon event for a specific user and network provider (ASN) within the last 24 hours, compared against a 14-day historical baseline. This can indicate initial access via compromised credentials or RDP exploitation.
Detects anomalous sign-in activity for users by comparing current successful login attempts against a 14-day historical baseline. The rule flags logins originating from new IP addresses, new applications, or new geographic locations, specifically identifying instances where at least two of these parameters deviate from the established historical norm for the specific user.
Detects the use of system utilities (wevtutil, PowerShell, wmic, etc.) or log-reading tools (grep, tail) for log enumeration or export when executed by processes that are not standard management or monitoring agents. This pattern is commonly associated with adversary efforts to gain situational awareness or identify security logs.
Detects the use of tscon.exe to specify a destination session without a password (potential RDP session hijacking) or the creation of a Windows service related to tscon execution.
This rule detects potential persistence attempts by monitoring for the creation of suspicious registry values (common autostart locations) or new files in the Windows Startup directory. It flags registry value data or file names that match known suspicious patterns (e.g., PowerShell, cmd, temp/appdata paths, URLs) when executed by processes other than trusted installers.
Detects DNS resolutions to popular threat intelligence, reputation, and sandboxing APIs (e.g., VirusTotal, URLScan, AbuseIPDB) originating from non-browser processes on non-analyst workstations. This behavior may indicate an attacker programmatically querying these services to verify if their infrastructure, payloads, or IP addresses are flagged as malicious, or to conduct reconnaissance.
Detects the creation or modification of Python configuration files (.pth, sitecustomize.py, usercustomize.py) within site-packages or dist-packages directories when not initiated by recognized Python package managers. Such files can be abused to achieve arbitrary code execution upon Python interpreter startup, a common method for persistence or local privilege escalation in Python environments.
Detects crontab modifications or suspicious command execution spawned by the cron daemon on macOS devices, indicating potential persistence or scheduled task abuse.
This rule detects a classic port knocking sequence followed by a connection to sensitive services (SSH, Telnet, RDP, VNC, WinRM). The rule identifies devices performing rapid connections to multiple different ports within a short window, which is indicative of a port knocking attempt used to trigger service exposure, followed by an immediate attempt to connect to that exposed service.
Detects the use of common command-line utilities (net, powershell, cmd) to perform user account creation or local group membership modification, which are behaviors often associated with adversary persistence or privilege escalation.
Page 3 of 13