Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
This rule detects a highly suspicious sequence of events in Microsoft Entra ID (formerly Azure AD) audit logs: a self-service password reset, followed by the registration of new security information, and then the deletion of existing security information, all performed by the same user within a short time window. This pattern is indicative of an attacker taking over an account, resetting the password, establishing their own MFA/security info, and then removing the legitimate user's security info to lock them out. This behavior has been observed in campaigns like Storm-2949.
Detects unauthorized processes reading or accessing the 'PhoneExperiences' SQLite databases. This behavior may indicate an attempt to steal synchronized SMS messages or One-Time Passwords (OTPs) via the Microsoft Phone Link application, bypassing MFA without needing mobile malware.
Detects the use of bitsadmin.exe to download a file with a foreground priority. This specific command line structure is used by the CloudZ RAT as a fallback payload download mechanism when curl and PowerShell Invoke-WebRequest fail.
Detects the creation of the specific scheduled task 'SystemWindowsApis' or scheduled tasks querying for the malicious payload paths (e.g., 'windosDoc'), utilized for persistence by the CloudZ loader.
Detects the creation of AF_ALG (kernel crypto API) sockets from Python processes or processes explicitly referencing the 'authencesn' cryptographic template. This behavior is heavily associated with the "Copy Fail" (CVE-2026-31431) local privilege escalation exploit, which uses a Python script to chain AF_ALG and splice() to overwrite page cache pages.
Detects PowerShell commands attempting to query the Terminal Services Remote Connection Manager event log for Event ID 1149. This may indicate adversary reconnaissance of RDP connection history to identify targets for lateral movement.
Detects the execution of the Set-MpPreference PowerShell cmdlet to disable Windows Defender real-time monitoring. This technique is frequently abused by malware and ransomware affiliates, such as The Gentlemen RaaS, to bypass endpoint defenses prior to payload detonation.
Detects the disabling of the Windows Firewall across all profiles using command-line tools such as netsh or PowerShell. This technique is commonly used by threat actors and ransomware affiliates, like The Gentlemen RaaS, to evade defenses and facilitate unrestricted lateral movement.
Detects the execution of PowerShell using the ExecutionPolicy Bypass flag combined with the Net.WebClient DownloadFile method. This pattern is frequently used by threat actors and ransomware affiliates, such as The Gentlemen RaaS, to stage payloads from internal or external servers.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
Page 4 of 10