Muhammad Nameer
@nameer1 follower0 downloads96 copies3 likes2,373 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
3
2
2
1
1
Platforms
3
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
3
2
1
1
1
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
Detects process executions where the command line contains an HTTP/HTTPS URL with an explicit IPv4 address instead of a domain name. This technique is often used by malware and downloaders to fetch payloads or communicate with C2 servers while bypassing DNS.
Identifies potential use of ROADtools for Azure AD reconnaissance by monitoring for Azure CLI/PowerShell App IDs coupled with a Python user agent in sign-in logs. This rule specifically looks for sign-ins to 'Windows Azure Active Directory' resource where the user agent string contains 'python' or the device detail string contains 'Python', and the App ID or App Display Name matches known Azure AD PowerShell or Azure CLI applications.