R W
@shiftyroot8 followers1,441 downloads177 copies78 likes4,581 views
60 detections
Filters
Last updated
All Time
Detection languages
31
13
5
4
3
Categories
18
14
10
8
8
Platforms
42
8
5
4
3
Products / Services
10
10
6
5
5
MITRE Techniques
27
18
18
17
10
Detects modifications to Group Policy Objects (GPOs) that enable script processing. Threat actors, such as Storm-2603, abuse GPOs to deploy ransomware (like Warlock) by adding malicious startup or logon scripts. This detection identifies when the "Group Policy Scripts" client-side extension is added to a GPO, which is a key step in this attack chain. This activity is logged under Event ID 5136 on Domain Controllers.
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
Detects the execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) with command-line arguments that are commonly used to bypass User Account Control (UAC) and execute malicious INF files. This technique is leveraged by malware like Katz Stealer.
This rule detects a sequence of successful Azure AD sign-ins from the same user and device. The first sign-in uses a refresh token (RT) for a non-interactive user session, specifically for the Microsoft Teams desktop client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e) from an Azure AD joined device, where the token protection status is 'unbound'. This is followed by a second successful sign-in using a primary refresh token (PRT) from the same user and device, excluding sign-ins to the 'Device Registration Service'. This sequence could indicate an adversary attempting to transition from an acquired refresh token to a primary refresh token, potentially to gain broader access or persistence within the Azure AD environment.
This rule detects the execution of common command and scripting interpreters (cmd.exe, cscript.exe, powershell.exe, pwsh.exe, powershell_ise.exe, wmic.exe, wscript.exe) when their parent process is either w3wp.exe or svchost.exe, and the command arguments contain keywords related to SharePoint. This behavior can indicate suspicious activity within a SharePoint environment, potentially related to web shell execution, privilege escalation, or data exfiltration.
This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.
This detection rule identifies processes that call the 'GlobalMemoryStatusEx' Windows API. This behavior is a known sandbox evasion technique used by malware, including SLOW#TEMPEST, to check the system's physical memory size before executing a malicious payload. The rule is tuned to focus on unsigned processes or those running from non-standard locations and with low host prevalence.
Detects PowerShell being executed with the '-WindowStyle Hidden' flag from a Windows Scripting Host parent process (wscript.exe or cscript.exe). This is a common technique used by malware, such as Katz Stealer, to run malicious scripts stealthily after being dropped by JavaScript.
Detects the creation of specific text files in the AppData directory, which is a known behavior of the Katz Stealer malware after it successfully decrypts and dumps browser master keys.
Generic rule content from file: Hunting Scheduled Tasks
winevent 4698
winevent 4698
Page 4 of 6