chiki briki
@ekkor13Completionist
0 followers5 downloads214 copies2 likes451 views
18 detections
Filters
Last updated
All Time
Detection languages
18
Categories
4
4
3
2
2
Platforms
14
2
2
1
Products / Services
5
4
2
1
1
MITRE Techniques
7
4
3
2
2
CVEs
1
1
1
Project CAV3RN
Cortex XDR
This rule monitors for indicators of compromise (IOCs) associated with a specific malicious activity or campaign, designated as 'Project CAV3RN'. It flags network communication with known malicious domains and IP addresses, as well as the execution or presence of specific file hashes and filenames (e.g., AzureCommunication.dll, logAzure.txt, NewProject.dll) related to the threat.
correlates two OS-generated artifacts on the same PID within a 120-second window: a seclogon-spawned process (CreateProcessWithLogonW is the only unprivileged API for remote profile loading) and a PostBootReminders\ProfileError\TempProfile registry write (ProfSvc marks fallback when tampered ntuser.dat breaks normal initialization). neither artifact is attacker-controlled. the time window filters PID-reuse false positives. an attacker could theoretically delay the oplock release beyond the window, so a secondary hunting query without the time filter should be run periodically.
detects manual additions to local Administrators, Remote Desktop Users, and Remote Management Users groups, resolving member SIDs to display names via AD sync, host inventory, and well-known SID mapping, with machine account and FQDN deduplication built in.
This rule detects instances of the 'su' utility being executed in a manner inconsistent with normal system administration patterns. By filtering out common, expected parent processes (such as login shells, terminal multiplexers, or established system services) and identifying 'su' command-line execution or shell commands attempting to invoke it, the rule flags potentially malicious privilege escalation attempts, such as those exploiting local vulnerabilities.
Suspicious wermgr.exe Creation Outside System Directory
AD User / Computer Profile
Cortex XDR
Search user by sam_account_name in pan_dss_raw. Returns full AD profile with UAC decoded to readable text, sensitive group membership check (Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account/Backup/Server Operators, DnsAdmins, GPO Creators, RDP Users, adminSDHolder). Variable: $input_username_or_computer_name
detects creation of QoS throttle policies in HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\ with ThrottleRate value. pacer.sys enforces these policies at the NDIS layer below WFP, throttling EDR agent bandwidth to near-zero and causing telemetry upload timeouts.
This rule detects the creation of a 'SymbolicLinkValue' registry value within the 'CloudFiles' 'BlockedApps' registry key. This specific registry modification is associated with techniques designed to bypass security restrictions, specifically related to the abuse of symbolic links in the context of Windows CloudFiles/OneDrive mechanisms to achieve unauthorized file system access or privilege escalation.
Page 2 of 2