Aaron etr
@sertg0 followers47 downloads24 copies1 like172 views
21 detections
Filters
Last updated
All Time
Detection languages
15
3
2
1
Categories
14
7
4
3
3
Platforms
19
2
1
Products / Services
4
3
3
2
2
MITRE Techniques
9
5
5
5
4
CVEs
1
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the loading of a kernel driver named 'g11.sys', which is associated with the PoisonX campaign, a technique typically used for kernel-level persistence or exploitation.
Detects the use of the Windows 'net use' utility to mount a C$ administrative share using explicit user credentials. This behavior is commonly associated with lateral movement techniques where an adversary attempts to connect to a remote system share to gain access, transfer files, or execute binaries.
Detects the execution of the PowerShell script 'install_ad.ps1' with the '-ExecutionPolicy Bypass' flag. This pattern is commonly associated with automated software deployment scripts, such as AnyDesk, and may be used by adversaries to facilitate malicious script execution while evading security policies.
This rule detects the execution of known NirSoft credential recovery utilities, such as WebBrowserPassView, ChromePass, and others, when they are located within a specific 'music/mimik/' directory structure, which is indicative of credential harvesting activities staged by an adversary.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
Detects a specific sequence of commands involving the termination of the AnyDesk process using taskkill, a short delay via the timeout command, and an immediate system reboot. This sequence is often associated with persistence setup or system preparation by threat actors.
Detects the execution of SniffPass, a known network password recovery tool often used by adversaries to capture passwords from various network protocols (e.g., POP3, IMAP, SMTP, FTP, and HTTP). The rule monitors process execution events for known SniffPass binary names and SHA256 hashes.
Detects the execution of NetScan.exe, a common network scanning tool often used by adversaries to perform internal network reconnaissance and identify active hosts and services within a compromised environment.
Detects the execution of reconnaissance commands (ipconfig.exe or tasklist.exe) launched directly by the PsExec service (psexesvc.exe). This pattern is often indicative of post-exploitation discovery activities following lateral movement using PsExec.
This rule monitors for the execution of known software utilities often used by adversaries to disable security controls, remove system locks on files, or tamper with security configurations. Specifically, it flags the usage of IObit Unlocker, Gmer (a known rootkit/tampering tool), and Defender Control (used to disable Windows Defender).
Page 2 of 3