Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower37 downloads923 copies20 likes2,913 views
121 detections
Filters
Last updated
All Time
Detection languages
73
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
22
17
Products / Services
21
20
17
11
7
MITRE Techniques
28
22
22
12
8
IDS Classtypes
1
This rule monitors for high or medium-risk user events and sign-in activities within Azure Active Directory. It correlates data from both the AADUserRiskEvents and SigninLogs tables to identify potentially compromised user accounts.
This rule detects the execution of Windows Explorer (explorer.exe) with specific command-line arguments involving a factory initialization sequence and an embedding flag. This command line pattern is typically associated with shell object manipulation or specific COM object instantiation, which may be leveraged for process injection or hiding malicious activity.
Detects Keycloak password reset attempts (UPDATE_PASSWORD) where the user has not performed the required preceding email verification (SEND_RESET_PASSWORD) and lacks a valid action-token. This pattern suggests an attempt to bypass the standard password reset workflow.
Detects Microsoft Teams messages containing specific external domains, which may indicate phishing or unauthorized sharing of malicious links within the organization.
This rule monitors the execution of the Outlook process (olk.exe) where the command line contains the argument 'upn='. This pattern is often associated with the manual invocation of Outlook components or potential credential manipulation, as user principal names (UPNs) are frequently used in authentication workflows and may be targeted or misused.
This rule detects scenarios where a user account registers or adds a new device and subsequently performs a sign-in session within one hour that is either marked as high/medium risk or occurs via sensitive applications like the Azure Portal or Microsoft Graph. This pattern often indicates account compromise, where an attacker has registered a rogue device to gain persistent access or perform administrative tasks.
Detects the execution of a binary named 'calc-mapping.bin' (either by image file path or command line arguments) where the parent process is 'node'. This pattern is indicative of a Node.js application spawning an unusual or potentially malicious binary.
Detects instances where the same user performs both a role assignment (potentially for privilege escalation) and executes a Run Command on an Azure Virtual Machine within a one-hour window. This behavior is indicative of an attacker modifying access control and immediately executing arbitrary code on the target resource.
Detects the creation or modification of inbox rules in Office 365 that involve automatic email forwarding, redirection, or deletion. Such rules are commonly created by adversaries to exfiltrate email data or maintain persistent access to a compromised mailbox.
Detects the execution of a file named 'calc-mapping.bin' when invoked directly or through a path, specifically when the parent process is named 'node'. This pattern may indicate the execution of a malicious binary or payload via a Node.js runtime environment.
Page 8 of 13