ᴅᴜᴛᴄʜʙᴏʏ 😎
@dutchboyTrusted contributorCompletionist
1 follower58 downloads627 copies19 likes30,810 views
35 detections
Filters
Last updated
All Time
Detection languages
35
Categories
9
9
7
5
5
Platforms
23
3
3
1
1
Products / Services
12
3
2
2
2
MITRE Techniques
16
15
15
13
12
CVEs
2
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
KQL Query from file: Check Vulnerable Citrix NetScaler
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Detects the execution of mshta.exe with a remote URL containing an .hta file in the command line. This pattern is commonly used by adversaries to proxy execution of malicious scripts via a trusted Windows binary, often initiated by common applications like explorer.exe or cmd.exe.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains)
This query hunts for potential execution linked to the Axios npm supply chain compromise by detecting node.exe process activity tied to suspicious npm lifecycle markers (postinstall, setup.js, plain-crypto-js). It helps identify systems that may have executed malicious install-time scripts.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Page 1 of 4