Niall Dunne
@Xavier22 followers34 downloads308 copies62 likes2,342 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
4
1
1
Platforms
6
1
1
1
Products / Services
5
MITRE Techniques
3
2
2
1
1
Looks for various IDE processes making network connections direct to IP. Excludes private IP ranges but might need contextual exclusions too for environment
This detection looks for various LOLBAS Processes that have download capabilities but are often seen rarely making network connections. They can be identified from the LOLBAS Project: https://lolbas-project.github.io/#/download
Seen in various campaigns including recent clickfix activity
Seen in various campaigns including recent clickfix activity
Detection Looks for powershell been used to disable AV/Defender within a system or evade detection through excluding drives/files. Actors will use this to bypass defenses or set up file exclusions to allow their custom files/binaries to execute.
Detects potential malicious use of LDAP queries associated with Metasploit activity targeting Active Directory. LDAP enumeration can reveal detailed information about users, groups, computers, and other objects within a network that can be exploited by attackers.
Identifies execution of the mshta LOLBAS utility with command arguments containing the http/https or ftp keyword, which could indicate that an attacker is executing a remotely hosted malicious file for possible code execution AND/OR attempting to ingress a file. Seen in campaigns like lumma stealer.
Detection looks for Powershell used with various cmdlets used to add certain filetypes to Defender AV exclusion, they would normally be blocked upon execution in certain ways. Allows an actor to execute their own files that normally would be blocked.