Darshil Mehta
@darshil0 followers0 downloads44 copies0 likes99 views
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Categories
1
1
1
1
1
Platforms
1
1
1
1
Products / Services
1
1
1
MITRE Techniques
2
1
1
1
1
CVEs
1
Detects HTTP POST requests with multipart form data containing PHP session identifiers and PHP session upload progress parameters, indicative of an exploit attempt against a PHP application vulnerability (CVE-2026-109619).
Detects PowerShell downloading and executing payloads from the temporary directory using common malware download cradles. Observed in during CLICKFIX-VIDAR campaign
This rule detects Microsoft Teams activities such as ChatCreated, MessageSent, or TeamsImpersonationDetected where the sender's display name matches common administrative or support-themed identifiers (e.g., 'IT Support', 'Help Desk', 'Global Admin'). This behavior is commonly associated with social engineering and phishing attempts designed to trick users into divulging credentials or sensitive information by masquerading as trusted enterprise support roles.