R W
@shiftyroot8 followers1,441 downloads177 copies78 likes4,581 views
60 detections
Filters
Last updated
All Time
Detection languages
31
13
5
4
3
Categories
18
14
10
8
8
Platforms
42
8
5
4
3
Products / Services
10
10
6
5
5
MITRE Techniques
27
18
18
17
10
Detects PowerShell obfuscation techniques in process command lines, including encoded commands, IEX with string manipulation, and long command lines with string functions, indicating potential malicious activity. The rule specifically looks for the use of '-encodedcommand' or its short forms with long command lines, 'iex' or 'invoke-expression' combined with string manipulation (like '+', '-join', '[char]', 'frombase64string') or very long command lines, and unusually long command lines that also contain string manipulation functions ('-join', 'replace', 'split').
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
This rule detects the installation of specific malicious open-source packages using npm or pip. It looks for process executions of 'npm.exe', 'pip.exe', 'pip3.exe', 'npm', or 'pip3' with 'install' in their command line, specifically targeting known malicious package names like 'winston-compose', 'nodemailer-helper', 'servula', 'velocky', 'vite-postcss-helper', 'pycryptoconf', and 'pycryptoenv'. This activity is indicative of supply chain compromise attempts, potentially by groups like Lazarus Group, who have been known to leverage such tactics.
Detects large data transfers over SSH/SCP (port 22) to or from an ESXi host. This activity is highly suspicious and could indicate an attacker delivering a ransomware payload to the hypervisor or exfiltrating sensitive data (like VMDK files).
Detects power-on or reconfiguration events for virtual machines located in vCenter folders designated for decommissioned or orphaned assets. Threat groups like UNC3944 are known to use such forgotten VMs as staging points for attacks, such as mounting disks from critical systems for offline data theft. Activity on these VMs is highly anomalous and warrants investigation.
Detects the disabling of the 'execInstalledOnly' kernel setting on an ESXi host, a critical security control that prevents the execution of unsigned binaries. This is often followed by a host reboot to apply the change. This TTP is used by threat groups like UNC3944 to prepare the hypervisor for custom ransomware execution.
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
Detects when a virtual disk (.vmdk) from one virtual machine is attached to a different virtual machine. This is a key TTP used by threat groups like UNC3944 to perform offline credential theft (e.g., copying NTDS.dit from a domain controller) by mounting the disk to a separate, attacker-controlled staging VM.
Detects the addition of a member to a sensitive Active Directory group related to VMware administration (e.g., 'vSphere Admins', 'ESX Admins') using net.exe executed via WinRM (wsmprovhost.exe). This behavior is a key TTP used by threat groups like UNC3944 to escalate privileges and gain control over the vSphere environment after an initial compromise.
Page 3 of 6