Bhojraj Joshi
@cybrbhojrajjoshiCompletionist
2 followers1 download157 copies6 likes10,646 views
30 detections
Filters
Last updated
All Time
Detection languages
30
Categories
12
11
7
6
6
Platforms
24
8
8
1
1
Products / Services
7
2
1
1
1
MITRE Techniques
12
10
7
7
4
CVEs
1
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.
This rule detects the execution or writing of a file with a specific SHA256 hash associated with the 'GateKeeper' payload. It monitors process creation events, new executable writes, PE file writes, and image loads on Windows platforms to identify the presence and activity of this known malicious file.
Detects the execution of processes from common user-writable directories such as Desktop, Downloads, AppData, Documents, and the Public folder. Adversaries often place and execute malicious payloads in these locations to evade detection and leverage user permissions. This rule helps identify potentially unauthorized or malicious software execution.
This rule detects suspicious activity related to a specific IP address (142.11.206.73) in network connections, or a specific domain (sfrclak.com) in DNS requests or process command lines. This could indicate communication with known malicious infrastructure or the execution of malware.
This rule detects the execution of specific suspicious executables (ProShow.exe, BluetoothService.exe, Bitdefender Submission Wizard.exe) when they are launched from user-writable directories such as 'Users' or 'AppData'. This pattern can indicate malware execution or persistence, as adversaries often drop and execute malicious payloads in these locations to evade detection and leverage user permissions.
This rule detects DNS requests to domains known to be associated with malicious browser extensions. These extensions often perform command and control (C2) or data exfiltration activities by communicating with these domains. The rule uses a regex to match both the primary domains and their subdomains, aggregating results by host and domain to identify repetitive beaconing.
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
This rule detects instances where 'node.exe' (Node.js runtime) acts as the parent process for 'rundll32.exe', and the command line of 'rundll32.exe' includes 'node-gyp.dll'. This combination can indicate an attempt to execute malicious code via a legitimate system binary proxy, potentially leveraging Node.js development tools for defense evasion or initial access.
Page 3 of 3