Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Detects when a successful AWS Console Login is immediately followed by discovery actions from the same user and IP address. This pattern is indicative of an attacker performing reconnaissance after gaining initial access, as seen in recent AWS phishing campaigns.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
Detects living-off-the-land (LotL) activity associated with Volt Typhoon, specifically the use of 'netsh.exe' to configure port forwarding (portproxy), which is used for lateral movement and C2 tunneling.
Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.
Detects when the same AWS IAM user ARN performs actions from more than one distinct source IP within a 1-hour window. Indicative of session hijacking, credential sharing, or AiTM compromise where attacker egress IP differs from the victim's IP. AssumedRole is excluded by default due to high noise from automation — add back with tuned ARN exclusions if needed.
Detects a FortiGate configuration file download occurring within 10 minutes of a successful administrative login from the same user and source IP address. This rapid sequence of events can indicate an attacker who has gained administrative access and is proceeding to exfiltrate sensitive configuration data, which may contain credentials for other systems.
Detects the usage of the finger.exe utility with suspicious command line parameters. finger.exe is a legacy Windows tool that is rarely used in modern environments and is being leveraged by the HellsUchecker malware to download malicious batch commands.
Detects the creation of the "C:\Nintendo" directory, which is a hardcoded developer backdoor used by the HellsUchecker malware to bypass anti-sandbox and anti-analysis checks.
Detects a PowerShell process reading its own or another script's content to extract a hidden payload. This technique was observed in the Dead#Vax campaign to deobfuscate and execute payloads stored within the script file itself.
Detects the creation of specific file artifacts used by the DeadVax loader as staging containers for encrypted payloads. The malware uses `rEgX.cmd` as a self-copy, `windows.dll` as a temporary text file to hold a Base64 payload, and `boot64x.w` to store the final shellcode.
Page 9 of 10