Paul Barrett
@peebsCompletionist
1 follower23 downloads188 copies4 likes4,111 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
1
Platforms
1
1
1
Products / Services
1
MITRE Techniques
1
1
CVEs
1
1
1
1
1
The detection assumes that a dedicated service account is used to run the PaperCut service.
This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
** Derived KQL from published Sigma rule created by @timpeck of the same title**
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Requires Defender DeviceNetworkEvents table
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
The query is designed to look for VSC extension use in the environment and determine who and which device the extension is being run on.
The query was built in support of detection for VSC extension abuse
The data from this query can be supported with inventorying of VSC through Microsoft SCCM
The query was built in support of detection for VSC extension abuse
The data from this query can be supported with inventorying of VSC through Microsoft SCCM
This query looks for PowerShell launched by WSUS-related processes, especially with encoded or suspicious commands, which aligns with observed exploitation patterns
This is a KQL adaption of submission by @topik
Detects suspicious administrative activities on F5 BIG-IP devices, such as
failed logins or configuration changes. This is based on recommendations from
F5 in response to a security incident disclosed in October 2025 where a threat
actor gained access to BIG-IP development environments. F5 advised customers
to enhance monitoring for admin logins, failed authentications, and privilege
and configuration changes.
Detects suspicious administrative activities on F5 BIG-IP devices, such as
failed logins or configuration changes. This is based on recommendations from
F5 in response to a security incident disclosed in October 2025 where a threat
actor gained access to BIG-IP development environments. F5 advised customers
to enhance monitoring for admin logins, failed authentications, and privilege
and configuration changes.