RamZy Sarkar
@sarakarbabu0 followers30 downloads71 copies4 likes1,444 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
3
3
2
1
1
Platforms
3
2
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
3
2
2
2
1
This rule detects the installation or execution of a wide range of common third-party VPN clients by monitoring process creation events. It specifically looks for process names associated with over 100 different VPN services. The rule includes exclusions for legitimate security software like Microsoft Defender and Microsoft Intune Agent, as well as Cisco AnyConnect VPN client installations.
This rule detects attempts to browse or access a predefined list of potentially malicious software packages. It monitors proxy logs for occurrences of these package names within the 'file.name' field. Further investigation of network traffic volume (bytes in/out) is recommended to ascertain if a download of the malicious package has taken place.
This rule detects the use of 'launchctl load -w' commands on macOS systems, which is a common method for establishing persistence by loading Launch Agents or Daemons. It specifically looks for process creation events where 'launchctl' is involved with the 'load -w' parameters, while excluding known legitimate processes from Palo Alto Networks, Apple, Zscaler, Adobe, Citrix, Microsoft, Netskope, Red Giant, and Logitech to reduce false positives.
This rule detects VPN connections originating from countries that are not the user's usual work country. It leverages VPN logs, specifically Zscaler VPN logs, to identify active connections and compares the source IP's country with a lookup of the user's expected work country. Alerts are generated when a mismatch is found, indicating a potentially unauthorized or suspicious access attempt.
Detects the execution of NetCat (nc) on macOS systems. NetCat is a versatile networking utility that can be used for various purposes, including port scanning, banner grabbing, file transfers, and creating backdoors. This rule specifically looks for process creation events where the process name is 'nc' and excludes known legitimate uses by 'Jamf Connect' and 'TruU Authenticator', as well as a specific health check script.
This power query is to detect NPM package is downloaded by the user, using the SentinelOne Singularity Power query.