Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,913 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
Detects the execution of common Windows command-line tools (such as cmd, powershell, or wmic) being used to query system information related to security configurations, antivirus status, firewall status, or installed security products. This behavior is indicative of an adversary performing reconnaissance to understand the defensive landscape of a compromised host.
This rule detects when common Windows applications (explorer.exe, svchost.exe, winword.exe, excel.exe, rundll32.exe) load DLLs that are either unsigned or located in user-writable directories (e.g., \Users\, \AppData\, \Temp\, \ProgramData\). This is a common indicator of potential DLL hijacking or side-loading attacks.
Detects the creation of executable or script files within non-system directories that were initiated by the OneDrive sync process. This activity may indicate a user downloading malicious files via a compromised OneDrive account or a malicious payload being synced to the local system.
Detects 'GetBlob' operations on Azure Storage blobs that have extensions commonly associated with executable files, scripts, or archives, which may indicate the retrieval of malicious payloads.
Detects anomalous GitHub activity where a single actor interacts with 20 or more unique repositories within a 24-hour period. This behavior is indicative of potential repository scraping, unauthorized data harvesting, or mass configuration changes associated with reconnaissance or exfiltration activity.
Detects processes attempting to access sensitive Linux system files (/etc/passwd or /etc/shadow) that are not typically associated with system administration, security, or identity management tasks. This behavior may indicate an attempt by an unauthorized user or process to gather credentials or system configuration information.
Detects instances where a specific user creates or deletes a Microsoft Power Automate flow that has active sharing permissions configured, potentially indicating unauthorized workflow manipulation or persistence attempts.
This rule identifies potential command-and-control (C2) beaconing behavior by detecting repetitive, consistent connections (low jitter) to public IP addresses over common TLS ports (443, 8443, 4443, 9443) from processes that do not have a known history of connecting to those destinations. It establishes a baseline of historical connections to filter out legitimate traffic and uses a statistical analysis of connection intervals to highlight suspicious, non-human-like automated communication patterns.
This rule detects potential Command and Control (C2) beaconing activity by identifying periodic outbound network connections from suspicious or non-browser processes. It analyzes the time deltas between successful network connections; if the standard deviation of these intervals is low (indicating consistent timing) and a sufficient number of connections occur, it flags the behavior as a potential C2 heartbeat.
Detects an internal source IP that has communicated with a high number of unique destination IP addresses and ports within a 24-hour period. This behavior is indicative of network reconnaissance or internal port scanning.
Page 5 of 13