Ishaan S
@isrv0 followers0 downloads4 copies0 likes31 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
2
2
1
1
1
Platforms
2
2
Products / Services
2
2
MITRE Techniques
2
2
1
1
1
Detects the execution of known living-off-the-land binaries or network utilities initiated by or involving processes related to the Semantic Kernel framework (e.g., SKAgent, kernel.run). This pattern is often indicative of automated execution, potentially associated with agent-based activity or malicious orchestration leveraging AI framework components.
This rule detects the creation of potentially malicious script or executable files (.bat, .ps1, .exe, .vbs) within the Windows Startup folder. It triggers when these files are created by processes typically used for automation or development (dotnet, python) or processes utilizing specific semantic/download-related command lines. The rule further correlates this activity with the presence of PowerShell commands indicative of script downloading or code execution (e.g., IEX, DownloadString) by the same device within the same timeframe, suggesting persistent execution of potentially malicious code.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.