Benjamin Zulliger
@benschaTrusted contributorCompletionist
27 followers229 downloads1,629 copies143 likes20,855 views
55 detections
Filters
Last updated
All Time
Detection languages
55
Categories
19
10
9
8
8
Platforms
29
15
6
4
4
Products / Services
24
8
8
5
4
MITRE Techniques
24
20
19
18
16
CVEs
1
This rule detects suspicious code search queries within Azure DevOps audit logs that may indicate an adversary is attempting to find sensitive information such as passwords, API keys, tokens, or private keys. It specifically looks for keywords like 'password', 'secret', 'token', 'apikey', 'api_key', 'connectionstring', 'connstring', 'credential', 'private key', and 'BEGIN RSA PRIVATE KEY' in code search queries.
This rule detects Azure DevOps activities originating from new or rarely seen IP addresses outside of defined business hours. It establishes a baseline of historical IP addresses and flags activities from IPs that have been seen for fewer than a specified number of days, indicating potentially suspicious access.
Detects attempts to disable or stop the 'auditd' service on Linux systems using common service management utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses and avoid logging of their malicious actions.
Detects instances where 'nslookup.exe' is initiated by 'explorer.exe'. This activity can be indicative of an adversary performing DNS queries for reconnaissance or command and control (C2) staging, especially when not part of a legitimate administrative script or user action. The rule excludes a common false positive related to conhost.exe.
This rule detects modifications to the 'RunMRU' registry key, specifically looking for new or changed entries where the command string is unusually long (greater than 50 characters). This can indicate an attempt to persist or execute malicious code via the RunMRU list, which stores recently executed commands.
This rule detects suspicious activity related to Microsoft Distributed Transaction Coordinator (MSDTC) where the OracleOciLibPath registry value is modified, followed by msdtc.exe loading an unsigned oci.dll within a 4-hour window. This behavior can indicate an attempt to hijack the DLL loading process for persistence or privilege escalation, potentially by an attacker replacing the legitimate Oracle OCI library with a malicious one.
Detects modifications to the Image File Execution Options (IFEO) or SilentProcessExit registry keys, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries may use these mechanisms to attach debuggers or monitor programs to legitimate executables, causing malicious code to run when the target application starts or exits.
thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
This query detects suspicious sign-in activity from a user who has recently clicked on a phishing link. It correlates email click events with sign-in logs, identifying sign-ins from new or infrequent IP addresses after a user has interacted with a suspicious email. The rule uses configurable parameters for sender email addresses, sender domains, and subject keywords to identify phishing emails.
Detects suspicious process access to common credential storage locations such as certificate stores, PCPKSP keys, and CloudAPCache for AzureAD credentials. The severity of the alert is escalated based on the initiating process and command line arguments, specifically looking for keywords like 'mimikatz', 'dump', or 'export'.
This rule detects when a certificate is issued to a privileged user. It identifies privileged users by checking their group membership against a predefined list of administrative groups such as 'Domain Admins', 'Enterprise Admins', and 'Administrators'. The rule then looks for Windows Security Event ID 4886, which indicates a certificate services operation, and extracts the principal name from the Subject Alternative Name field. Finally, it joins this information with the identified privileged users to flag any certificate issuance to them.
Page 2 of 6