Bhojraj Joshi
@cybrbhojrajjoshiCompletionist
2 followers1 download157 copies6 likes10,646 views
30 detections
Filters
Last updated
All Time
Detection languages
30
Categories
12
11
7
6
6
Platforms
24
8
8
1
1
Products / Services
7
2
1
1
1
MITRE Techniques
12
10
7
7
4
CVEs
1
This rule detects the execution of suspicious filenames (FunnyApp.exe, RedSun.exe, undef.exe, z.exe, powershell.exe) from common user download or pictures directories. Adversaries often place malicious executables in these locations to evade detection and execute their payloads.
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
Detects instances where 'explorer.exe' initiates network connections to domains associated with Cloudflare Tunnel (trycloudflare.com). This behavior can indicate the use of tunneling software, potentially for malicious purposes such as command and control, data exfiltration, or bypassing network restrictions. While Cloudflare Tunnel has legitimate uses, its connection by 'explorer.exe' is unusual and warrants investigation.
This rule detects when critical services, including security agents, backup solutions, and remote management tools, are stopped on a host. Adversaries often stop these services to evade detection, disable security controls, or inhibit system recovery during attacks like ransomware.
Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.
This rule detects instances where a 'node.exe' process initiates an outbound network connection over HTTPS (port 443) to a domain within the '.vercel.app' top-level domain. This could indicate development activity, but also potential malicious use of Node.js applications for command and control or data exfiltration to cloud services.
Generic rule content from file: untitled_rule
Detects suspicious execution paths for svchost.exe, known malicious SHA256 hashes, or suspicious registry persistence mechanisms. Specifically, it looks for svchost.exe or a file named images.png executing from the 'Users\Public\Windows' directory, known malicious hashes, or a registry run key named 'Windows Update Service' under 'Software\Microsoft\Windows\CurrentVersion\Run'.
This rule detects the execution of a 'curl' command on macOS that attempts to make a POST request to a file named 'salmonela' within the '/tmp/' directory. This pattern is highly suspicious and could indicate an attempt to exfiltrate data, upload malicious content, or interact with a temporary malicious script.
This rule detects suspicious processes (winupdate.exe, windows.exe, svchost.exe, system32.exe) initiating network connections from unusual directories (Downloads, Public, System32) to known cloud storage providers (Amazon AWS, DigitalOcean, Azure Blob Storage) or over port 443. This behavior could indicate data exfiltration, command and control activity, or malware communication.
Page 2 of 3