Paul P
@ppritch0 followers1 download245 copies4 likes2,611 views
15 detections
Filters
Last updated
All Time
Detection languages
15
Categories
9
6
3
3
3
Platforms
13
2
Products / Services
6
1
1
1
1
MITRE Techniques
6
5
5
5
4
CVEs
2
Detects PowerShell processes launched by Windows Explorer, which is characteristic of a user executing a command from the 'Run' dialog (Win+R). The detection targets command lines associated with the "ClickFix" social engineering technique, which tricks users into running malicious code. This includes looking for encoded commands or specific strings from the "reCAPTCHA Phish" toolkit.
This rule identifies network connections or BITS transfer jobs targeting specific IP addresses and URLs associated with recent ClickFix campaigns. It also detects the use of system utilities like bitsadmin.exe and powershell.exe to download files, a common tactic for these threats.
Detects the MSHTA utility (mshta.exe) executing a remote script which then spawns a .NET registration utility (RegAsm.exe or RegSvcs.exe). This specific execution chain is a high-confidence indicator of malware loaders like XWorm and Lumma Stealer, often delivered via ClickFix social engineering lures.
Detects network connections to domains and IPs associated with the Notepad++ supply chain attack. These indicators are linked to the distribution of Cobalt Strike and the Chrysalis backdoor.
Detects the telnetd process spawning child processes with highly suspicious environment variables, such as a modified PATH or LD_PRELOAD. This can indicate an attempt to hijack execution or move laterally, and is a technique associated with CVE-2026-24061.
Detects when a suspicious process (such as a script interpreter or LOLBIN) is executed from a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious executables or scripts in these locations to bypass security controls and execute them, often as a result of a user opening a malicious document.
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Detects tar.exe being spawned by processes commonly associated with initial access or lateral movement, such as web servers or remote management services. This activity is highly indicative of post-exploitation activity like data staging.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, etc.) spawns a suspicious child process (like cmd.exe or powershell.exe) from a document located in a configured Office Trusted Location. While trusted locations are meant to bypass macro security warnings, the subsequent spawning of shell processes is a strong indicator of malicious macro execution for post-exploitation activities.
Detects the creation of a new Microsoft Office Trusted Location via registry modification. Attackers abuse this feature to add a location they control, allowing macros or other active content to run without security warnings, bypassing Mark-of-the-Web (MotW) protections.
Page 1 of 2