Chamath Rathnasekara
@chamathr0 followers0 downloads32 copies0 likes637 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
CVEs
1
Detects the execution of known Remote Monitoring and Management (RMM) tools from common user-writable or temporary directories (Temp, Downloads, AppData, Public). The rule further filters for processes commonly abused for payload delivery and command execution (powershell.exe, cmd.exe, wscript.exe), or processes containing typical obfuscation and download indicators, excluding benign system process initiators.
Detects potential NTLM credential leakage caused by SnippingTool.exe making outbound network connections (SMB / Web) that result in NTLM authentication, consistent with CVE‑2026‑33829 exploitation.