Tim P
@bobbyTablezCompletionist
3 followers422 downloads34 copies17 likes806 views
13 detections
Filters
Last updated
All Time
Detection languages
11
1
1
Categories
5
3
2
1
1
Platforms
11
1
Products / Services
4
4
3
1
MITRE Techniques
5
3
3
3
2
Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) execution by using Get-Variable to parse out IEX characters from the MaximumDriveCount built-in variable and reconstruct them via -Join.
Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) of a malicious script behind the Get-Alias or Get-Command cmdlet shortcuts (gal/gcm).
Detects DNS lookups to common Tor proxy gateways such as tor2web and onion.* mirrors. These domains are often used to proxy access to hidden services from non-Tor browsers and are frequently used by threat actors for staging, data exfiltration or ransomware payments.
This rule leverages Windows Security logs to detect potential lateral movement or staging activity involving a known artifact used by NetScan, a portable network scanning tool. Specifically, it monitors for attempts to write or delete files like `delete.me` across network shares.
This rule looks for the usage of less common PowerShell modules which interface directly with the current user's clipboard. This could be an attempt to steal sensitive data or attempt to modify clipboard contents.
This rule looks for a common hijacking method involving modification of the AppDomainManager in .NET applications. The 'dfsvc.exe' process can be relocated or renamed, and when paired with a crafted config file, may execute malicious code from DomainManager.dll before the application loads.
Detects EnemyBot Botnet Malware
This detection looks for a method of creating potentially malicious LNK (Shortcut) files by using the CreateShortcut() function. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
This rule detects the presence of a plain text artifact in a common download scenario in PowerShell where the second required portion of the command is not present. This could be an attempt to obfuscate the script in order to evade detections.
This rule detects potential fake captcha code execution through the Windows "Run" dialog box. Attackers will often pad the end of a malicious command string with a fake
comment like "I am not a robot: CAPTCHA Verification UID:7811" to trick users into executing malicious code.
comment like "I am not a robot: CAPTCHA Verification UID:7811" to trick users into executing malicious code.
Page 1 of 2