Nicholas Isakson
@nisakson2000Completionist
2 followers24 downloads424 copies9 likes4,448 views
19 detections
Filters
Last updated
All Time
Detection languages
19
Categories
5
4
4
3
3
Platforms
11
3
3
3
Products / Services
10
4
3
3
2
MITRE Techniques
6
5
4
4
3
Detects when the Tamper Protection feature of Windows Defender is disabled. This action is often taken by adversaries or malicious software to weaken endpoint defenses and facilitate further compromise or concealment of malicious activity.
Detects unauthorized attempts to modify Microsoft Defender Tamper Protection registry keys. The rule correlates registry value changes from '5' (Enabled) to '0' or '4' (Disabled) against Microsoft Defender Antivirus Troubleshooting Mode events to distinguish between legitimate administrative troubleshooting and potentially suspicious local tampering.
This rule alerts when Cato's inline Anti Malware engine identifies a file in transit as malicious. It fires on both blocked and allowed malware to catch cases where the engine detects but fails to block, indicating a potential compromise or a misconfiguration requiring immediate investigation.
This rule analyzes historical logon, process, and network activity for a specified device over a configurable lookback period. It aims to validate whether a device, potentially flagged as decommissioned or stale, exhibits a pattern of sporadic, legitimate use (e.g., executive laptops, break-glass machines) rather than continuous or unauthorized activity. The output provides a daily timeline of activity, helping to differentiate between truly dormant assets and those with intermittent, legitimate usage.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
This query provides a 360-degree view of a phishing campaign's impact. Starting from a reported email's indicators (sender, subject), it finds all similar emails and correlates them with user actions like URL clicks, attachment interactions on endpoints, replies, and if the emails were zapped by Microsoft. This allows an analyst to quickly scope an incident and determine the extent of compromise.
This rule detects the installation of known malicious browser extensions associated with the ChatGPT Stealer campaign. These extensions are designed to steal AI session tokens and conversation data by monitoring file creation or renaming events in directories where browser extensions are typically installed.
Detects periodic network traffic (beaconing) from browser processes to external domains, which may indicate automated data exfiltration by a malicious extension like the ChatGPT Stealer. This threat is known to exfiltrate data at approximately 30-minute intervals.
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
Page 1 of 2