karim gi
@kappanello2 followers4 downloads55 copies0 likes505 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
Platforms
2
MITRE Techniques
1
1
1
1
CVEs
1
1
This rule is designed to detect potential RDP session hijacking activity within the environment. RDP session hijacking occurs when an existing Remote Desktop session is taken over or reassigned without initiating a new authentication process.
Monitoring this behavior helps identify suspicious attempts to interact with or assume control of active remote sessions.
Monitoring this behavior helps identify suspicious attempts to interact with or assume control of active remote sessions.
Detects potential exploitation of CVE-2021-1675 / CVE-2021-34527 (PrintNightmare) via anomalous SMB access to the IPC$ share targeting the "spoolss" named pipe (AccessMask: 0x3).
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
This query monitors and detects the creation of Outlook rules that move emails to the “Conversation History” or “Deleted Items” folders. The goal is to promptly identify potential attempts to hide suspicious emails by a possible threat actor.