R W
@shiftyroot8 followers1,441 downloads177 copies78 likes4,581 views
60 detections
Filters
Last updated
All Time
Detection languages
31
13
5
4
3
Categories
18
14
10
8
8
Platforms
42
8
5
4
3
Products / Services
10
10
6
5
5
MITRE Techniques
27
18
18
17
10
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
This rule detects advanced memory exploitation techniques, including anomalous memory protection changes (non-executable to executable), writes to executable memory regions within the same process, large executable memory allocations followed by network activity, and potential format string exploit attempts in web logs. It aims to identify behaviors indicative of bypassing ASLR and DEP.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
This rule detects PowerShell script blocks that attempt to bypass AMSI (Antimalware Scan Interface) by patching or manipulating memory related to AMSI. It specifically looks for the presence of keywords like 'VirtualProtect', 'GetProcAddress', 'InteropServices', 'AmsiScanBuffer', and references to 'amsi.dll' or 'clr.dll' within PowerShell operational logs (EventID 4104). This combination of keywords indicates an attempt to programmatically interfere with AMSI's ability to scan script content.
This rule detects the creation of processes associated with various legitimate remote access and remote monitoring/management (RMM) tools. It specifically looks for common executable names and patterns for tools like AnyDesk, TeamViewer, ngrok, Splashtop, ScreenConnect, ConnectWise Control, Pulseway, TacticalRMM, Tailscale, and Level. The rule includes exclusions for specified administrative users and legitimate parent processes to reduce false positives. The primary goal is to identify potentially unauthorized or suspicious usage of these tools, which can be leveraged by adversaries for remote access, command and control, or data exfiltration.
This detection identifies a sequence of command-line activities consistent with techniques used by state-sponsored actors. The rule looks for the execution of multiple native Windows reconnaissance or credential dumping commands from a single host and user, which is a common pattern for actors performing hands-on-keyboard operations after gaining initial access.
Detects potential DCSync attacks by identifying Event ID 4662 where specific DS-Replication access rights are used by a non-domain controller. This rule specifically looks for attempts to replicate directory changes (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set) from an IP address that is not a known domain controller, while also excluding common system accounts.
NTLM Relay Attempt
YARA-L
Detects NTLM successful network logons where the source and destination workstations are the same, excluding loopback addresses. This behavior can be indicative of NTLM relay attacks where an attacker relays authentication from a victim to the victim's own machine, or other forms of NTLM abuse.
This rule detects potential data exfiltration attempts via email by monitoring internal users sending emails to external domains. It flags suspicious activity based on three criteria: a high volume of emails sent (over 100) combined with a large total data size (over 50 MB), a significant number of emails sent to personal domains (over 20), or a notable count of emails with sensitive subjects (over 5). The rule aggregates these metrics over a 1-day window for each user.
Detects potential LLMNR/NBT-NS poisoning by identifying a single host responding to a high number of distinct client IPs on UDP ports 137 (NBT-NS) or 5355 (LLMNR). This behavior is indicative of an attacker attempting to spoof name resolution to redirect traffic.
Page 2 of 6