Ethan Anderson
@ethanCompletionist
1 follower21 downloads51 copies14 likes23,368 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
3
2
1
1
1
Platforms
6
Products / Services
4
1
1
1
1
MITRE Techniques
4
2
1
1
1
This rule detects suspicious command-line activity related to enabling Remote Desktop Protocol (RDP) access. Specifically, it looks for `netsh.exe` commands that add a firewall rule to allow inbound TCP traffic on port 3389 (RDP) or enable the 'Windows Management Instrumentation (WMI)' firewall group. It also detects `reg.exe` commands that modify the `fDenyTSConnections` registry value to enable RDP connections.
This rule detects attempts to modify the local Administrators group using the 'net localgroup administrators' command. This command is often used by adversaries to add users to the local administrators group for privilege escalation or persistence.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Detects the execution of a Cloudflared that uses 'tunnel run' with a long token, which is indicative of a tunneling tool being used. This pattern is often associated with legitimate remote access tools or potentially malicious C2 frameworks.
This rule detects modifications to Windows Defender exclusion paths in the registry. Adversaries may modify these registry keys to add exclusions for their malicious files or processes, allowing them to evade detection by Windows Defender. The rule specifically looks for changes to the 'Exclusions\Paths', 'Exclusions\Processes', and 'Exclusions\Extensions' keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender.
This rule detects PowerShell command lines that contain non-English (Unicode) characters, excluding the en-dash character. This behavior is often indicative of obfuscation techniques used by adversaries to evade detection, as legitimate PowerShell commands typically do not contain such characters in their command line arguments.