Kenji Choy
@kchoyCompletionist
0 followers124 downloads299 copies8 likes27,553 views
23 detections
Filters
Last updated
All Time
Detection languages
15
8
Categories
4
3
3
3
2
Platforms
11
3
Products / Services
6
3
1
1
1
MITRE Techniques
6
6
4
4
4
This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events from data mapped to the Elastic Common Schema (ECS).
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
Page 3 of 3