Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
This rule detects the installation of potentially unwanted or suspicious applications, specifically looking for a sponsored version of FileZilla. It then correlates this installation with outbound network activity to public IP addresses, which could indicate telemetry, beaconing, data exfiltration, or command and control (C2) behavior.
This rule detects DNS queries to known malicious domains by joining IdentityQueryEvents with ThreatIntelligenceIndicator data. It specifically looks for matches between the queried domain (QueryTarget) and known malicious domains (DomainName) from threat intelligence feeds.
This rule detects suspicious command-line activity, specifically file downloads using 'curl' initiated by a web browser. This behavior may indicate malicious JavaScript or HTML triggering command execution, a user being tricked into clicking a link that launches a command, or initial access/payload download in a phishing or drive-by attack.
This rule identifies all enabled service accounts in the environment. The goal is to audit the state of service accounts to identify unused or stale accounts, ensure only necessary service accounts are active, reduce the attack surface, and support compliance and security posture assessments. While not directly detecting malicious activity, it provides crucial visibility for security hygiene and can help identify potential accounts that could be abused by adversaries for persistence or defense evasion.
This rule identifies devices that are missing recommended security updates based on data from Microsoft Defender for Endpoint's TVM (Threat and Vulnerability Management) capabilities. It joins vulnerability information with knowledge base articles to pinpoint specific missing updates.
This rule identifies potentially suspicious signed binaries in the environment by looking for files signed by 'OneStart Technologies LLC' and excluding common, known good vendors. This helps detect the abuse of code signing certificates by threat actors to bypass security controls and can support threat hunting and malware analysis.
This rule detects potential obfuscated or stealthy PowerShell execution by identifying PowerShell commands that do not use the default 'powershell' or 'pwsh' executable names but still contain common PowerShell command-line arguments such as '-NoProfile', '-ExecutionPolicy', or 'Invoke-Expression'. It correlates these executions with user logon sessions to aid in attribution and threat hunting.
This rule identifies all logon events within the organization's domain by querying the IdentityLogonEvents table. It extracts distinct account display names, UPNs, device names, destination device names, action types, account domains, and applications involved in the logon.
This rule detects PowerShell activity on user workstations within 30 minutes of receiving an email from a known malicious sender. It aims to identify potential post-compromise activity initiated by a successful phishing attempt.
This rule identifies file download events initiated by common web browsers such as Microsoft Edge, Internet Explorer, Google Chrome, and Mozilla Firefox. It can be used for hunting suspicious file downloads on devices, especially after an incident alert, or for general threat hunting.
Page 8 of 10