Rica Grande
@cbrarkitect1 follower16 downloads39 copies18 likes477 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
1
1
1
1
1
Platforms
5
1
Products / Services
3
1
1
MITRE Techniques
3
2
1
1
1
This rule detects Attack Surface Reduction (ASR) block events where a file operation was prevented. It specifically filters out audit-only events and excludes operations on .dll and .tmp files to reduce noise. The rule aims to identify malicious activity that ASR has actively blocked, indicating a potential attempt to execute or modify files in a suspicious manner.
This rule identifies events from Keeper BreachWatch indicating potential credential compromise. It specifically looks for logs categorized as 'breachwatch' and extracts details about the breach, including compromised domains and risk severity, along with the affected username and remote IP address.
This rule detects the creation or modification of registry values within common Auto-Start Extensibility Point (ASEP) Run keys. It specifically flags entries that point to suspicious file paths (e.g., C:\Users\Public\, C:\ProgramData\, temporary directories) or contain suspicious command-line interpreters (e.g., rundll32, mshta.exe, powershell.exe, wscript.exe, cscript.exe). The rule filters out modifications made by known legitimate processes to reduce false positives.
Identifies devices that have been observed as being directly exposed to the public internet. This is based on Microsoft Defender for Endpoint's device discovery capabilities. Such devices may be at higher risk of attack and should be reviewed to ensure the exposure is intentional and properly secured.
Detects attempts to remove traces of Remote Desktop Protocol (RDP) activity by clearing specific event logs, deleting registry keys, or removing cache files. This rule identifies command-line actions using 'wevtutil' to clear RDP operational logs, 'reg delete' for RDP client registry keys, and 'del' or 'remove-item' for RDP bitmap cache files. It also directly monitors registry events for RDP client key deletions and file events for RDP cache file deletions.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.