Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects Windows Security Center Event ID 15 indicating that a registered security product, such as Windows Defender or VIPRE, has been turned off or snoozed. Attackers actively uninstall or disable endpoint security agents immediately prior to deploying ransomware to ensure successful encryption without interference.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
Detects Cursor IDE spawning download utilities or LOLBins commonly used for
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
Detects execution of a binary from common staging directories shortly after
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
Detects potential DNS tunneling, a technique used by the Mori backdoor (associated with MuddyWater), by identifying an unusually high volume of long DNS queries from a single source. This could indicate C2 communication or data exfiltration.
Detects the creation of a specific scheduled task used by Interlock ransomware to execute its payload with SYSTEM privileges.
Detects the creation of registry Run or RunOnce keys that point to executables mimicking popular VPN clients. This technique is used by threat actors like Storm-2561 to establish persistence for their malicious payloads, which are often fake VPN clients designed for credential theft. The rule specifically looks for these executables being run from non-standard locations, such as user profiles, instead of the legitimate 'Program Files' directory.
Detects the creation of a scheduled task named 'Runtime Broker' that executes files from 'C:\ProgramData\Microsoft\Windows\Runtime\'. This technique is used by the Slopoly malware, deployed by the Hive0163 group, to establish persistence by masquerading as a legitimate Windows service.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Page 8 of 10