Jeremy Goldstein
@jeremys11 follower1 download42 copies1 like2,260 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
4
3
3
1
1
Platforms
5
1
1
Products / Services
1
1
1
MITRE Techniques
4
3
3
2
2
CVEs
1
This rule detects network connections (both inbound and outbound) on TCP/UDP port 18789, excluding connections initiated by processes from well-known publishers like Microsoft, Apple, and Google. This port is not commonly used by legitimate applications and could indicate the presence of custom malware, command and control (C2) communication, or other unauthorized network activity.
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
Detects the creation of a process named 'wt.exe' within the 'ProgramData' directory, which is an unusual location for a legitimate executable and could indicate malicious activity. Exclusions are in place for common administrative tools and specific endpoint naming conventions to reduce false positives.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
