chiki briki
@ekkor13Completionist
0 followers5 downloads214 copies2 likes451 views
18 detections
Filters
Last updated
All Time
Detection languages
18
Categories
4
4
3
2
2
Platforms
14
2
2
1
Products / Services
5
4
2
1
1
MITRE Techniques
7
4
3
2
2
CVEs
1
1
1
LDAP Query Extractor | Cortex XDR
Cortex XDR
Extracts LDAP search queries from Microsoft-Windows-LDAP-Client Event ID 30 logs on endpoints. Accepts hostname, username, or IP as input. Shows initiating process with full command line, search filter, base DN, and requested attributes. Good for triaging LDAP enumeration alerts and identifying whether queries come from known AD tools or suspicious recon activity.
Detects cortex-xdr-payload.exe connecting to a server outside Palo Alto Networks LRC infrastructure. Attackers can abuse the Live Terminal feature as a pre-installed, EDR-trusted C2 channel by redirecting the payload to their own server using a URL validation bypass in the server hostname check
Shows all Kerberos authentication activity on domain controllers - TGT requests, TGS requests, and pre-auth failures (4768/4769/4771). Good for hunting credential attacks, AS-REP roasting, weak encryption usage, and account lockout troubleshooting.
Detects role assignments made directly by a user, bypassing PIM workflow direct assignments are permanent, don't require approval, and don't expire
Surfaces Silverfort-detected incidents excluding ImpossibleTravel (high FP rate from VPN and mobile users, better covered by XSIAM Analytics UEBA)
Pulls the full content of every PowerShell, VBS, and JS script executed on a given host. Use * in both parameters to get everything
ShieldBreak CVE-2026-50656 Cortex XDR
Cortex XDR
unsigned process loading both MpClient.dll and cldapi.dll in the same process instance. this is the core behavioral invariant of CVE-2026-50656 exploitation - MpClient is needed to trigger scan/remediation via RPC, cldapi provides the cloud filter callback that swaps file content mid-scan. neither DLL can be removed without breaking the exploit. with Cortex XDR as primary AV, Defender runs in passive mode and the exploit fails at scan stage, but the DLL load pattern still gets recorded by the agent. this rule detects the attempt, not the successful exploitation.
Extracts full PowerShell script content from DOT_NET telemetry (dynamic_event_string_map key 25), grouped by process causality ID so each row = one script execution with its complete body. Filter by hostname or username via parameter. Use for investigating script-based alerts, hunting suspicious PowerShell, or validating FP exclusions
PKINIT DC Impersonation from Non-DC Host
Cortex XDR
This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.
This rule detects the execution of known malicious files associated with the FakeGit campaign by matching their SHA256 hashes. Additionally, it identifies suspicious process execution patterns involving 'luau.exe', specifically when it is launched as a standalone process or when initiated by command-line scripts such as .cmd or .bat files.
Page 1 of 2