Francesco Bocchi
@fra_0 followers3 downloads92 copies3 likes594 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
1
1
Platforms
2
1
1
Products / Services
2
1
1
MITRE Techniques
1
1
1
1
1
Hunts DeviceFileCertificateInfo for files signed by certificates issued by the eight eMudhra (and eight Sectigo) intermediate CAs with compromised weak keys. It matches on issuer hash, issuer name and CA serial, with an optional broader eMudhra/emSign match.
This rule monitors for processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS) with permissions (PROCESS_VM_READ and PROCESS_QUERY_INFORMATION) typically required for credential dumping. It filters out processes that have historically performed this action in the last 30 days to reduce noise and highlight potentially malicious or anomalous activity.
This rule detects suspicious activity where a new device is registered after a user browse or click on a Microsoft device login page. This could indicate an adversary attempting to register a new device to bypass multi-factor authentication or establish persistence.