Richard Kohler
@djrk01Completionist
0 followers9 downloads22 copies0 likes140 views
24 detections
Filters
Last updated
All Time
Detection languages
24
MITRE Techniques
2
2
Detects an attacker preparing a Linux host for SSH key-based persistence. The behavior chain is: (1) clearing the immutable and append-only attributes on the .ssh directory using chattr -ia, (2) deleting the .ssh directory with rm -rf, and then planting a new attacker-controlled public key in authorized_keys. Clearing the attributes removes protections that would otherwise block modification or deletion, even by root, and gives the attacker a clean slate to install their own key and often re-lock it with chattr +ia. This sequence was observed in honeypot data and is commonly associated with automated SSH botnet and cryptominer campaigns. False positi
Detects modifications to the Windows registry that suppress Windows Defender notifications. It monitors the Notification_Suppress value under the Windows Defender\UX Configuration key for being set to 1, which silences Defender’s security alerts to the user. Adversaries (including Azorult malware) use this defense-evasion technique to operate without alerting the victim or triggering visible security warnings. Maps to MITRE T1562.001 (Impair Defenses) and T1112 (Modify Registry).
Detects users searching for hosts or passwords using open source tools. Exclude intelligence teams and soc team.
Detects a potentially compromised webshell being executed on windows IIS server. This would mean a threat actor has gained access into a server, potentially looking to backdoor or elevate privileges.
Detects a potential webshell being executed on linux server. Follow process tree of shell commands.
Detects compromised users who are disabling windows backups. Seen commonly in pre encryption during ransomware attacks.
Detects the enabling/installing of services and applications via DISM.exe. Exclude IT workers, and look for baseline of all users leveraging DISM.
Detects rundll32.exe loading a DLL from a user-writable staging directory and invoking its Begin export, a loader pattern used in the Ghost CMS/ClickFix campaign. Since legitimate software rarely loads DLLs from these locations via a Begin export, this is a high-fidelity indicator of malicious proxy execution (MITRE T1218.011).
Detects when a user is downloading or listing SharePoint files from the cli.
Detects when a user is accessing potentially sensitive IT related files. Exclude IT users domain.
Page 1 of 3