Richard Kohler
@djrk01Completionist
0 followers9 downloads22 copies0 likes140 views
24 detections
Filters
Last updated
All Time
Detection languages
24
MITRE Techniques
2
2
Detects a potential remote installation of application through http. Look for suspicious parent processes or unusual application installs.
Detects when a user is accessing potentially sensitive IT related files. Exclude IT users domain.
Detects when a user is downloading or listing SharePoint files from the cli.
Detects users searching for hosts or passwords using open source tools. Exclude intelligence teams and soc team.
Detects a potential webshell being executed on linux server. Follow process tree of shell commands.
Detects compromised users who may be attempting to change defender settings to allow malicious events to unfold. Each option produces different results.
Detects the enabling/installing of services and applications via DISM.exe. Exclude IT workers, and look for baseline of all users leveraging DISM.
Detect a user linking the dev/null space to shell histroy file to evade shell command histroy from logging. There are few false positive examples.Follow users command history prior.
Detects compromised users who may be attempting to change defender settings to allow malicious events to unfold. Each option produces different results.
Detects a potentially compromised webshell being executed on windows IIS server. This would mean a threat actor has gained access into a server, potentially looking to backdoor or elevate privileges.
Page 2 of 3