Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,911 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
Detects instances where a shell process (powershell, cmd, mshta, or wscript) is spawned by a browser-related process (explorer, wt, or SearchHost) shortly after a user focuses on a web browser, followed by a network connection from that shell within a short time window. This pattern is indicative of potential web-based exploitation or file download and execution chains.
Detects the execution of command interpreters (PowerShell, CMD, WindowsTerminal) spawned by common user-facing applications (Explorer, WindowsTerminal, DLLHost) where the command line arguments contain keywords associated with automated human verification (e.g., CAPTCHA, bot detection) and suspicious download/execution patterns (e.g., iex, base64). This behavior is characteristic of malicious automated scripts or malware attempting to bypass security challenges via interactive shells.
Detects instances where a single account adds a large volume of users (over 50) to a Microsoft Teams chat within a one-hour window. This behavior could indicate automated activity, potential bulk addition by an attacker to facilitate phishing or spam, or unauthorized group modifications.
Detects the installation of common remote access tools (such as TeamViewer, AnyDesk, or ScreenConnect) followed by an external network connection within a 10-minute window, which may indicate unauthorized remote access setup.
Detects the presence of Chrome Remote Desktop processes or execution of Windows Installer (msiexec.exe) and GoogleUpdate.exe, which are often used by adversaries for remote access or as a proxy for malicious payload execution.
Detects instances where common web browsers (Chrome, Edge, Firefox, IE) download executable or compressed files to drives other than the C: drive. This behavior may indicate an attempt to evade standard security monitoring or hide malicious payloads on secondary volumes or removable media.
This rule identifies potential DNS tunneling or beaconing activity by detecting an unusually high volume of DNS queries (exceeding 50 requests) made to a specific domain name within a given timeframe. Such patterns are often associated with C2 communication or data exfiltration via the DNS protocol.
This rule correlates Microsoft Entra ID (formerly Azure AD) identity risk events with sign-in activity and behavioral analytics for a specific user to facilitate forensic investigation of potential identity compromise. It aggregates risk events, anomalous sign-in attempts (including failures or failed conditional access), and suspicious behavioral telemetry from the same source IP addresses associated with identified user risk.
This rule detects potential data exfiltration by monitoring write activity to external USB storage devices. It identifies scenarios where a high number of files (more than 25) or a significant total volume of data (more than 100MB) is written to a connected USB device within a short timeframe.
This rule correlates Microsoft Entra ID (formerly Azure AD) risk events identified as 'passwordSpray' with subsequent sign-in logs from the same source IP address within a 60-minute window. This helps identify successful or suspicious authentication activity originating from an IP address previously flagged for password spraying attempts against a specific user account.
Page 6 of 13