John Bambenek
@bambenek1 follower15 downloads12 copies4 likes217 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
1
KQL Query
This detects the registry change needed to perform the TypeLib .COM bypass to execute the identified script let
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
This KQL/MDE query looks for the user of PowerShell initiated from explorer that could indicate Win+R or Win+X initiation. It will extract a URL from the command and display it if present