Matthew Metcalf
@mattmetcalf059Completionist
0 followers14 downloads124 copies1 like990 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
1
1
Platforms
1
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
Detects file activity under Chrome Extensions folder where the extension ID matches a known malicious ID list pulled from a GitHub markdown feed. Flags devices that may have installed or loaded malicious browser extensions.
Identifies outbound network connections from endpoints to domains associated with the DarkSpectre malicious browser extension campaigns, including Zoom Stealer, ShadyPanda, and GhostPoster infrastructure. This query is intended to support threat hunting and incident investigation by highlighting browser-initiated communications to known high-confidence infrastructure used for real-time data exfiltration, surveillance, and remote payload delivery. Results should be reviewed in context with initiating process, user activity, and installed browser extensions.
This detection identifies emails linked to a recent widespread phishing campaign that abuses trusted Microsoft SharePoint links to bypass traditional security controls. Attackers use convincing business emails containing SharePoint URLs that lead to multi-step validation pages, mimicking legitimate Microsoft authentication flows. These techniques make the attacks highly deceptive and harder to detect, as the initial links appear legitimate.
This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials.
Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials.
Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
Detects when a user’s Outlook successfully connects to a high-risk nation-state domain (e.g., .ru, .cn, .kp, .ir) correlated to an email they received, highlighting potential exposure to malicious content.