Awais Munir
@iawaishttps://threatnexus.onlineTrusted contributorCompletionist
15 followers193 downloads1,508 copies159 likes54,085 views
76 detections
Filters
Last updated
All Time
Detection languages
67
9
Categories
18
14
14
10
9
Platforms
69
6
2
2
2
Products / Services
43
13
5
4
3
MITRE Techniques
16
13
12
9
7
CVEs
2
Detects creation, modification, disabling, or deletion of Windows Firewall rules and profiles using netsh.exe or PowerShell NetSecurity cmdlets. Adversaries tamper with the host firewall to disable defenses, open inbound or outbound paths for tools and C2, or remove blocking rules. This is common in hands-on-keyboard intrusions and ransomware staging. The query matches on file name and original file name to catch renamed binaries, covers both modern (advfirewall) and legacy (netsh firewall) syntax, and labels each event with the action performed to speed up triage.
Inventories ConnectWise/SkyKick service principals in your tenant by app ID, vendor tenant ID (3f9cd7a0-127a-4ed4-bf06-2f830d5616b7) or name. Enabled apps need disabling first (disable, don’t delete, since deleting removes the consent). Disabled or deleted apps are contained but still need an audit of credentials and roles on other apps, because disabling doesn’t remove planted secrets. CanEscalateOrPlant shows apps holding app-only rights to add credentials or assign roles.
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Detects Entra sign-ins from infrastructure tied to the ConnectWise Cloud Backup (SkyKick) credential abuse: 144.172.64[.]128 (Huntress), plus 144.172.64[.]99 and 144.172.64[.]60 (ConnectWise advisory, Oct 18). Covers service principal sign-ins and user sign-ins, which captures the Oct 13-14 password spray. A success means a token was issued, so treat it as an incident. Failures still show targeting.
Flags service principal sign-ins by the ConnectWise/SkyKick app IDs from a public address or a Python/curl client. Per Huntress, the vendor apps normally egress from Azure private IPv6 (fd...) and call Graph with the kiota-dotnet SDK. Both conditions together are the strongest signal. This survives IP rotation. Baseline your tenant first, since a legitimate public egress would show here.
Detects the trusted .NET host used in Blinder Tunnel to run an attacker-supplied AppDomainManager: a renamed signed Visual Studio hosting binary as RuntimeBroker.exe, or vshost32.exe for the Blackwood tunneling tool. The attacker’s <host>.exe .config names the malicious DLL, which loads before any host code. The genuine RuntimeBroker.exe only runs from System32, and the \Microsoft\RuntimeBrokers\ install folder does not exist on a clean Windows install. The path arm therefore still fires if the actor renames the host. A LaunchContext field separates first execution (MSBuild/devenv .csproj trigger or Inno Setup installer) from Explorer autostart.
Detects the persistence mechanism used by ShelbyLoader V2 (RuntimeBroker.dll), the loader in the Iran-nexus Blinder Tunnel campaign (CL-STA-1178). The implant writes HKCU\...\Run\MicrosoftRuntime pointing at %LOCALAPPDATA%\Microsoft\RuntimeBrokers\RuntimeBroker.exe, then re-asserts it hourly. The genuine RuntimeBroker.exe is a System32 COM broker that is never autostarted from a Run key, so matching either the implant’s value name or RuntimeBroker.exe in Run data gives a near-binary signal with no allow-list. Covers both the Unit 42 and Nextron variants.
Generic rule content from file: Iranian APT - Blinder Tunnel - MicrosoftRuntime Run Key Persistence.cql
Detects the Blackwood tunneling tool from Blinder Tunnel. Blackwood.dll is sideloaded into a signed vshost32.exe via its .config and reflectively loads Go-compiled Chisel, which dials a raw public IP and opens a reverse SOCKS proxy for lateral pivoting.
Page 1 of 8