Awais Munir
@iawaishttps://threatnexus.onlineTrusted contributorCompletionist
15 followers193 downloads1,508 copies159 likes54,085 views
76 detections
Filters
Last updated
All Time
Detection languages
67
9
Categories
18
14
14
10
9
Platforms
69
6
2
2
2
Products / Services
43
13
5
4
3
MITRE Techniques
16
13
12
9
7
CVEs
2
Hunts for multi-stage attacker behavior involving executables dropped to user directories, co-located DLL loads, and outbound network connections to Azure cloud domains used as command-and-control infrastructure. This query surfaces advanced adversary tradecraft where payload delivery, code execution, and cloud-based C2 are tightly correlated.
Detects potential Subtle Snail-style DLL side-loading attacks where an unsigned or untrusted DLL is loaded by a signed and trusted parent process from user-writable directories (Downloads, AppData, Temp). This method highlights signature-mismatch scenarios often leveraged by APT and malware actors to stealthily execute malicious code while bypassing traditional defenses.
Detects registry persistence attempts via Run and RunOnce keys in both user and machine hives, focusing on value names and data referencing known Subtle Snail malicious files and suspicious payload names. Tracks registry modifications indicating adversary attempts to maintain persistent execution through stealthy implant DLLs and executables.
Detects high-fidelity execution of executables spawned from Office applications or browsers after engaging with recruitment-themed lures (e.g., LinkedIn, careers). Focuses on EXE files created and executed within 24 hours in user directories (Downloads, Temp, AppData), reflecting Subtle Snail’s social engineering and document-based initial access methods.
Detects suspicious scheduled task creation (schtasks.exe /create) linked to known Subtle Snail file hashes, malicious payload filenames, and recruitment paths. Correlates with parent processes commonly abused (browsers, explorer) and excludes benign system processes and service accounts. Aggregates events to highlight clustered activity for effective threat hunting.
Detects high-fidelity DLL side-loading in user-writable folders (Downloads, AppData, Temp) where an unsigned or untrusted DLL—created shortly before it is loaded—is executed by a trusted, signed process. This query correlates DLL load timing, signature metadata, and parent process trust to surface sophisticated attack chains, such as those used by Subtle Snail and Lazarus APT groups.
This specialized KQL query is designed to hunt for a particularly dangerous class of malicious activity: the deliberate disabling of Endpoint Detection and Response (EDR) security controls. It specifically targets the use of tools like EDR Silencer, which attackers deploy to "blind" security tools and operate stealthily on a compromised host. The logic focuses on high-confidence indicators, searching for the tool's executable itself or its distinctive command-line flags (blockedr, unblockall, etc.) when launched by common system interpreters like PowerShell or CMD. By filtering out noisy, legitimate activity related to document processing, this query provides security analysts with a prioritized list of potential EDR tampering incidents, enabling rapid investigation and response to this critical threat.
This hunting query detects adversaries attempting to impair or disable power-related functions in Windows environments. It covers explicit powercfg.exe commands, registry tampering of HibernateEnabled, deletion/modification of the hiberfil.sys file, and suspicious PowerShell usage. Such activity is often leveraged by attackers to maintain persistence or disrupt forensic evidence.
This detection identifies suspicious use of wreply or redirect_uri parameters in ADFS or Microsoft login URLs. Attackers can abuse these parameters to redirect users to non-Microsoft domains after authentication, a technique commonly referred to as ADFSjacking.
Detects potential token theft, impersonation, or privilege escalation activity in Windows environments by monitoring ProcessPrimaryTokenModified events. This query highlights suspicious changes in SIDs, token sources, integrity levels, or privilege flags, including attempts to impersonate SYSTEM or add high-risk privileges (SeDebugPrivilege, SeImpersonatePrivilege). Such behavior is strongly associated with lateral movement and privilege escalation techniques used by APTs, ransomware operators, and red team tooling like Mimikatz and Cobalt Strike.
Page 6 of 8