Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
Detects Microsoft Teams messages containing links to Pastebin. Threat actors (e.g., Nimbus RAT operators) use Pastebin to host instruction checklists and payload URLs during vishing attacks.
This rule detects a multi-stage attack chain associated with the Nimbus RAT, starting with a suspicious Microsoft Teams message (vishing) from an external sender using throwaway domains (e.g., .onmicrosoft.com, .top). This initial communication is then correlated with subsequent reconnaissance activities performed via Quick Assist, where QuickAssist.exe spawns cmd.exe to execute commands like 'net time', '/domain', 'whoami', 'ipconfig', or 'systeminfo' on the victim's device within a two-hour window. The rule aims to identify the internal victim and the external sender involved in this coordinated attack.
Detects the creation of a scheduled task named '\MicrosoftSystem64', which is a specific Indicator of Compromise (IoC) associated with the Windows variant of the FAMOUS CHOLLIMA / MicrosoftSystem64 RAT malware for persistence. The rule identifies this activity through Windows Event Log (Event ID 4698 for task creation), command-line execution of 'schtasks.exe' with '/create' and the specific task name, and Defender EDR telemetry for scheduled task creation.
Detects the creation and execution of specific temporary batch scripts (sstar-*.cmd) used by SStar Agent to execute shell commands on Windows endpoints. This rule specifically looks for 'cmd.exe' processes where the command line contains 'Temp' and matches the regex pattern 'sstar-[^"'\s]+\.cmd'.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This technique is used by the SStar Agent RAT for its remote 'type' functionality.
Detects the creation of conhost.exe running as NT AUTHORITY\SYSTEM, excluding expected system parent processes like csrss.exe and smss.exe. This behavior can be indicative of privilege escalation or an interactive system shell delivery, as seen in exploits like RedSun (CVE-2026-41091).
Detects the creation, modification, or renaming of the TieringEngineService.exe executable within the System32 directory. This activity is associated with the RedSun exploit (CVE-2026-41091), which leverages Defender remediation redirection to plant a malicious binary. The rule specifically filters out legitimate Windows update operations originating from the WinSxS directory to reduce false positives.
Detects the creation of the '\REDSUN' named pipe, which is used by the CVE-2026-41091 exploit for inter-process communication. This pipe facilitates the transfer of session ID information between the user-level exploit and the SYSTEM-level payload.
Page 3 of 10