Navdeep Sharma
@navvi24Completionist
4 followers34 downloads620 copies20 likes27,266 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
1
1
1
1
1
Platforms
4
2
1
1
Products / Services
2
2
1
1
1
MITRE Techniques
3
3
2
2
2
CVEs
1
Detects Entra ID users with active medium-to-high identity risk events who perform Microsoft Copilot actions in cloud applications while simultaneously exhibiting impossible travel indicators — successful sign-ins from multiple geographic locations using unmanaged (non-registered) devices within a one-hour window. This triple-signal correlation (identity risk + impossible travel on unmanaged device + Copilot usage) is a strong indicator of account compromise where an adversary has taken over a legitimate identity and is leveraging AI-powered tools to accelerate reconnaissance, data access, or exfiltration against Microsoft 365 resources.
This hunting query detect detects network traffic and browser events communicating with TDS nodes and landing pages associated with an IRSF SMS scam campaign leveraging fake CAPTCHAs.
This query detects network traffic and file events associated with the "AiFrame" malicious browser extension campaign. These extensions pose as AI assistants but exfiltrate user data via remotely controlled iframes.
This query hunts for indicators of compromise associated with the Notepad++ hosting breach attributed to the Lotus Blossom (aka Billbug) threat actor. It detects the Chrysalis backdoor execution chain, specific DLL side-loading techniques, and network connections to known malicious infrastructure.
This query identifies devices that have accepted inbound web traffic (ports 80/443) where the accepting process is IIS worker (w3wp.exe) or IIS Express (iisexpress.exe). It focuses on public IPv4 sources (excluding RFC1918/private, loopback, and IPv6), helping you surface internet-exposed web servers that are actively receiving external connections.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
This query hunts for indicators of compromise (IOCs) and behaviors linked to the LockBit 5.0 ransomware variant. It identifies the creation of the ransom note, suspicious file renaming patterns using hexadecimal extensions, and network connections to known command-and-control (C2) infrastructure associated with LockBit activity.
This query hunts for various indicators of compromise (IOCs) and behaviors associated with the Shai-hulud 2.0 malware campaign. This includes suspicious command-line activity related to the installation of the Bun runtime, privilege escalation on Linux, defense evasion, credential scanning with TruffleHog, destructive commands, and supply chain poisoning.
The .cfd Top-Level Domain (TLD) is often linked to malicious activities such as phishing, malware distribution, and command-and-control (C2) operations. This query detects new allowed network connections to .cfd domains that have appeared for the first time in your environment within the past 24 hours. Monitoring these connections can serve as an early warning sign of potential security breaches or users being targeted by phishing attacks. The query also provides valuable context for each newly observed domain, including its first-ever occurrence within a 30-day window, the total recent access count, and the users involved—enabling analysts to quickly evaluate the associated risk.