R W
@shiftyroot8 followers1,441 downloads177 copies78 likes4,581 views
60 detections
Filters
Last updated
All Time
Detection languages
31
13
5
4
3
Categories
18
14
10
8
8
Platforms
42
8
5
4
3
Products / Services
10
10
6
5
5
MITRE Techniques
27
18
18
17
10
Detects the creation of a new HKEY_CLASSES_ROOT (HKCR) shell open command entry that points to an executable in a temporary directory. This persistence technique is used by Warlock Dark Army ransomware.
Detects malicious files (web shells, backdoors, and tools) associated with the exploitation of SharePoint vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This rule matches known file hashes.
This rule detects HTTP POST requests to specific SharePoint application paths, including ToolPane.aspx and SignOut.aspx. These paths have historically been associated with SharePoint vulnerabilities, particularly unauthenticated remote code execution (RCE) exploits. The rule aims to identify attempts to interact with these sensitive endpoints, which could indicate an attacker attempting to exploit known vulnerabilities or perform unauthorized actions.
This rule detects suspicious device registration activity in Azure Active Directory (now Entra ID). Specifically, it looks for a sequence of two events: first, a 'Device Registration Service' adding a device with 'CloudAccountEnabled' set to true and a specific Windows build number (10.0.19041.928) in the user agent, followed by an attempt to add registered users to the device, referencing 'urn:ms-drs:enterpriseregistration.windows.net'. This sequence could indicate an adversary attempting to register a new device to bypass conditional access policies or gain persistent access.
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
The following EQL query can be used to hunt for XMRIG executions within your environment.
Detects the AUTHENTIC ANTICS malware by identifying strings related to its registry-based execution frequency control. The malware reads and writes to the 'Counter' value within 'HKCU\\Software\\Microsoft\\Office\\16.0\\Outlook\\Logging' to ensure it only runs periodically.
Active exploitation of CVE-2025-53770 involves the creation of this file, indicating successful post-exploitation.
This detection was established prior to our discovery of this new execution technique. It was originally designed to identify a different method (which requires the user to click on the Taskpad after opening the MSC file) that exploits the same MSC file type to execute commands through the Console Taskpads command line attribute:
This detection identifies attempts to disable or tamper with Microsoft Defender Antivirus using common command-line tools. This is a frequent defense evasion technique used by threat actors, including those exploiting SharePoint vulnerabilities, to operate undetected on a compromised host.
Page 5 of 6