Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Detects the disabling of the Windows Firewall across all profiles using command-line tools such as netsh or PowerShell. This technique is commonly used by threat actors and ransomware affiliates, like The Gentlemen RaaS, to evade defenses and facilitate unrestricted lateral movement.
Detects the use of curl to download files from Google Drive directly into the C:\Windows\Temp directory. This behavior was observed in an in-memory loader attack chain deploying ScreenConnect.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory via msiexec.exe, indicating potential unauthorized deployment observed in an in-memory loader attack.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.
Detects the specific command line sequence used by Aura Stealer to terminate its process, overwrite its binary with zeros using fsutil, and delete the file to evade forensic recovery.
Detects PowerShell commands attempting to retrieve the installed UI culture name. This specific technique is utilized by the EtherRAT SYS_INFO module to check the system's locale and selectively self-destruct on CIS-region machines.
Detects the execution of pcalua.exe proxying mshta.exe, a known indirect command execution technique used in the initial access phase of EtherRAT via ClickFix to bypass command-line interpreter restrictions and execute remote HTA scripts.
Detects registry modifications to the Run key via reg.exe that include the conhost.exe executable with the undocumented --headless parameter. This technique is used by EtherRAT for persistent, stealthy execution of its Node.js payloads.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens phishing campaign lures. Attackers rely on this PaaS platform to host device code phishing pages and bypass domain reputation checks.
Identifies web requests to commonly abused PaaS platforms (Cloudflare Workers, Vercel, AWS Amplify) or the Microsoft device login endpoint.
This rule acts as a base to identify specific events for downstream correlation. To properly detect a device code phishing sequence (such as EvilTokens), correlate a PaaS access event followed by a device login event from the same Source IP within a 5-minute window.
This rule acts as a base to identify specific events for downstream correlation. To properly detect a device code phishing sequence (such as EvilTokens), correlate a PaaS access event followed by a device login event from the same Source IP within a 5-minute window.
Page 5 of 10