Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
This query identifies devices that have specific software installed, enriching this information with device details like OS, exposure level, and internet-facing status. This is useful for asset inventory and identifying potentially exposed endpoints, especially when vulnerability information might not be immediately available through other means. The current rule is configured to detect "Acronis Cyber Protect" software.
KQL Query
This query detects evidence of the CrashFix malicious command being stored in the Windows Run dialog (Win+R) history. The RunMRU registry key stores commands executed via the Run dialog. This is a strong indicator that a user was prompted to and did execute the malicious command.
KQL Query
This rule identifies devices connected to Wi-Fi networks that have successfully established connections to public IP addresses. It lists details such as the device name, network adapter information (name, status, vendor), the public IP address connected to, and the first/last seen connection times, along with a count of connections. The primary goal is to provide visibility into Wi-Fi device network configurations and their external communication.
The rule is designed to detect suspicious activities associated with Remote Monitoring and Management (RMM) tools by analyzing processes, file signatures, network connections, and firewall logs linked to known RMM tools and domains. The rule is valid.
This query identifies devices with potentially malicious or unwanted browser extensions and detects outbound connections to known adware or tracking domains for threat hunting.
This rule identifies internet-facing devices that have Notepad++ installed with versions outside of a specified approved list. It correlates software inventory with device exposure data to highlight externally exposed systems, summarizes the affected Notepad++ versions per device, and prioritizes results based on exposure level for risk-based remediation.
This KQL query identifies known suspicious Windows service activities on devices by comparing them with an external list of suspicious services.
Page 3 of 10