Paul P
@ppritch0 followers1 download245 copies4 likes2,611 views
15 detections
Filters
Last updated
All Time
Detection languages
15
Categories
9
6
3
3
3
Platforms
13
2
Products / Services
6
1
1
1
1
MITRE Techniques
6
5
5
5
4
CVEs
2
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Detects the execution of the 'login' process with the '-f' flag, which skips authentication. When spawned by 'telnetd', this is a strong indicator of exploitation of CVE-2026-24061, a critical authentication bypass vulnerability.
Detects when the 'AllowNetworkLocations' or 'AllowSubfolders' registry values are enabled for Microsoft Office. This change broadens the attack surface by allowing Office to trust documents from network shares or any subdirectory within a trusted path, which can be abused by attackers to execute malicious payloads from attacker-controlled shares or hidden directories.
Detects the execution of the native Windows tar.exe utility to create archives of sensitive files or directories. This behavior is often associated with data staging for exfiltration.
Detects the execution of the native Windows tar.exe utility with flags that redirect the output to standard output (stdout) instead of a file. This behavior can indicate data being staged for exfiltration or piped to another tool for in-memory execution, bypassing file-based detections.
Page 2 of 2