Daniel Miller
@dxmiller4 followers19 downloads232 copies7 likes2,634 views
11 detections
Filters
Last updated
All Time
Detection languages
11
Categories
3
2
2
2
2
Platforms
5
3
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
3
3
3
3
3
CVEs
3
3
1
This rule detects a correlated attack chain involving LDAP Service Principal Name (SPN) enumeration followed by Kerberoasting activity. It identifies an actor performing LDAP queries for SPNs, then links that actor to subsequent Kerberos Ticket-Granting Service (TGS) requests for those service accounts within a defined time window. The rule specifically looks for a minimum number of unique service accounts targeted to trigger an alert, indicating a potential Kerberoasting attack.
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
This query parses the complex JSON parameters of the New-TransportRule and Set-TransportRule commands to find instances where email is being secretly copied externally or security is being lowered.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
This rule detects anomalous logon activity for accounts containing 'your admin service account name' by comparing actual logon volumes against a dynamically generated machine learning baseline. It focuses on identifying deviations from expected behavior for these administrative service accounts over a 14-day lookback period, with a sensitivity threshold of 2.5.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) utilizing data from the Imperva WAF leveraging vm#, child_process#, util_#, & fs_# indicators.
This query looks for DISM enable & disable events on the same device within a 15-minute window.
This detection identifies network traffic to domains explicitly listed as associated with recent phishing campaigns. It specifically looks for these domains within the RequestURL field of logs from Palo Alto Networks or Cato Networks firewalls/proxies.
Page 1 of 2