Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Detects PowerShell script blocks containing the scenario="incomingCall" XML attribute, which triggers Windows' special incoming call notification UI with accept/dismiss buttons and an avatar image loaded from an attacker-controlled URL. Sourced from the toastnotify-bof repository incoming-call.xml example payload. Near-zero legitimate enterprise use of this attribute in PowerShell.
Detects PowerShell constructing toast notification XML with an external HTTP image URL alongside WinRT toast API calls. When the notification is displayed the notification platform fetches the image, creating an outbound connection to an attacker-controlled server for delivery confirmation. Sourced from the toastnotify-bof repository incoming-call.xml and teams-security-alert.xml example payloads.
Detects Invoke-CredentialPhisher (legacy tool) or the sendtoast keyword in PowerShell script blocks. Both are direct indicators of an active toast notification-based credential phishing operation in progress.
Detects PowerShell constructing toast notification XML containing an activationType attribute combined with a protocol scheme. This pattern creates a clickable notification button that launches a URI handler, the primary mechanism for delivering phishing links via toast notifications. Covers both msteams:// protocol links and generic protocol handlers.
Detects PowerShell enumerating Application User Model IDs via the notification settings registry hive, the Get-StartApps cmdlet, or the System.AppUserModel.ID extended property on .lnk shortcuts. Attackers use these to discover trusted AUMIDs to impersonate in fake toast notifications.
Detects a high volume of 'git push --force' events specifically targeting tags from a single user or to a single repository within a short timeframe.
This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
Detects a sudden spike in Windows RestartManager Event ID 10000. A proliferation of RestartManager events is a strong indicator of active file encryption by ransomware (like INC or Akira) attempting to kill processes that are locking target files.
Detects a 'git push --force' event in GitHub audit logs. A force push overwrites the remote repository's history with the local history, which is a potentially destructive action.
This technique was notably used in the supply chain attack against the 'aquasecurity/trivy-action' repository, where attackers force-pushed malicious versions to existing version tags.
This technique was notably used in the supply chain attack against the 'aquasecurity/trivy-action' repository, where attackers force-pushed malicious versions to existing version tags.
Detects attempts to disable Windows Defender/Security features via command line arguments targeting antivirus, behavior monitoring, real-time protection, and WMI autologger defender components.
Detects the execution of INC ransomware utilizing specific command-line arguments (--sup, --hide, --mode medium) typically staged from the C:\perflogs\ directory. This pattern indicates active ransomware execution during the impact phase of an attack.
Page 7 of 10