Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Detects programmatic token refresh activity using the BAV2ROPC user agent originating from Railway IP space. This indicates automated persistent token cycling mechanisms used by the EvilTokens Phishing-as-a-Service (PhaaS) campaign to maintain access to compromised Microsoft 365 accounts.
Detects command lines containing 'mshta', an argument flag such as '-c' or '/c', and a remote HTTP/HTTPS URL. This pattern is often used by adversaries to proxy execution, such as using 'pcalua.exe -c' to pass a remote HTA payload to 'mshta.exe', as observed in the initial access phase of EtherRAT infections.
This rule detects potential device code phishing attempts where a user accesses a commonly abused Platform-as-a-Service (PaaS) platform (Cloudflare Workers, Vercel, Amplify) and subsequently attempts to log in via the Microsoft device login endpoint within a 5-minute window. This sequence of events is indicative of an adversary luring a user to a malicious site hosted on a PaaS platform to capture a device code, which is then used to authenticate to Microsoft services.
Detects execution of ToastNotify.exe with the sendtoast subcommand, which dispatches a phishing notification with a title and body text using a specified AUMID for impersonation. Review CommandLine for Windows.Defender.SecurityCenter, MSTeams_8wekyb3d8bbwe, or MSEdge to identify the application being impersonated.
Detects the unexpected installation of Node.js by an unusual parent process (such as VS Code, cmd, or PowerShell). This behavior is indicative of the StoatWaffle downloader, which automatically fetches and installs the Node.js runtime if it is absent from the target environment.
Detects execution of ToastNotify.exe with the getaumid subcommand, which enumerates registered Application User Model IDs from the HKCU and HKLM notification settings registry hives. This is the reconnaissance phase of a toast notification phishing attack, used to identify trusted AUMIDs to impersonate.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
Detects any execution of ToastNotify.exe, the .NET assembly used to dispatch phishing toast notifications impersonating legitimate applications. This catch-all rule fires when the binary runs with an unrecognized or absent subcommand. In environments that support rule ordering, evaluate subcommand-specific rules (getaumid, sendtoast, custom) before this rule. ToastNotify.exe has no known legitimate enterprise use.
Detects PowerShell script blocks loading the WinRT ToastNotificationManager API or using the ContentType=WindowsRuntime type accelerator syntax. Used by attackers to programmatically send fake toast notifications impersonating legitimate applications such as Microsoft Edge, Teams, or Windows Security.
Detects execution of ToastNotify.exe with the custom subcommand, which accepts a base64-encoded XML toast payload decoded at runtime via CryptStringToBinaryA. This is the most flexible attack mode, supporting protocol links, fake input forms, external images, and spoofed application UI. The XML content is not recoverable from the command line alone.
Page 6 of 10