Andrea Cuore
@ZeroDayGlowCompletionist
0 followers40 downloads54 copies1 like132 views
10 detections
Filters
Last updated
All Time
Detection languages
6
3
1
Categories
4
3
1
1
1
Platforms
5
4
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
3
3
2
2
1
CVEs
1
Detects FIREANT BridgeAgent backdoor and companion systemd unit
Rileva l'esecuzione del binario /usr/bin/acpid (path anomalo rispetto al legittimo /usr/sbin/acpid) con command line contenente artefatti di un toolkit di persistenza Linux.
Rileva la presenza di stringhe riconducibili a un toolkit di persistenza Linux (pid file di monitoraggio, binari grub typo-squattati) all'interno del contenuto di script eseguiti sull'host.
Rileva l'esecuzione di un binario denominato acpid da un percorso diverso da /usr/sbin/acpid, tecnica di masquerading osservata in toolkit di persistenza Linux.
This rule detects potential Local Privilege Escalation (LPE) activity related to a threat dubbed 'Rogue Planet'. It monitors for the creation of temporary files in the local AppData directory with a 'RP_' prefix and the usage of a specific named pipe named 'RoguePlanet'. The rule further isolates suspicious behavior by identifying processes that are not the standard Windows Error Reporting Manager (wermgr.exe) executing from its legitimate path.
Detects potential residential proxy usage based on network connections to known proxy-related ports and proxy infrastructure indicators in CrowdStrike Falcon logs.
This rule identifies emails containing URLs that point to known malicious domains used in phishing campaigns. It joins email URL information with core email event details to report the sender, recipient, subject, and the specific malicious domain associated with the URL.
This rule detects activities characteristic of the 'Gentleman' ransomware, including the creation of a specific ransom note file ('README-GENTLEMAN.txt'), attempts to tamper with Windows Defender security preferences, and the destruction of system recovery artifacts such as Volume Shadow Copies and various system logs/prefetch files.
This rule is designed to reconstruct an investigative timeline around a specific device and timestamp identified by an initial network event. It aggregates process execution, file activity, network connections, and alert evidence from the affected device within a specified time window before and after the triggered pivot event, facilitating incident investigation and root cause analysis.
Detects the use of common 'net' utility commands used by attackers to enumerate local and domain users and groups, such as domain admins or Exchange-specific security groups. This activity is a common indicator of reconnaissance during the post-exploitation phase.