Ali AlEnezi
@siteCompletionist
2 followers45 downloads259 copies6 likes5,242 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects network traffic patterns indicative of a Netcat-based reverse shell associated with the UAT-11823 (Sandworm) threat group. The rule monitors for characteristic command output such as 'uid=' and 'gid=', shell error strings containing '/bin/sh', and root shell prompts ('root@#') following suspected exploitation of CVE-2026-20079.
Detects modifications to credentials associated with Azure AD service principals or applications, such as adding new secrets or certificates. This behavior is commonly associated with attackers maintaining persistence or escalating privileges by creating backdoored credentials.
This rule identifies IoT devices that have reported critical or high severity software vulnerabilities within the last 24 hours. It correlates DeviceTvmSoftwareVulnerabilities data with DeviceInfo to specifically isolate vulnerable IoT-categorized assets and provides a summary of affected devices, software, and the associated CVEs to prioritize remediation efforts.
This rule aggregates vulnerability data from Microsoft Defender for Endpoint (Threat and Vulnerability Management) over the last 7 days. It groups vulnerable devices by CVE ID and severity level, providing an overview of known software weaknesses currently present across the fleet.
Detects a sequence of activity where an anonymous AWS token is requested via a specific API path, followed within 15 minutes by a token minting call from the same source IP. This behavior is indicative of a token-theft or privilege escalation chain.
Detects the execution of command-line tools (powershell, cmd, bash, curl, etc.) originating from common package managers and build tools (npm, node, pip, python, yarn). The rule flags these processes if they contain command-line arguments indicative of suspicious activity such as base64-encoded commands, remote script execution (IEX, curl/wget to shell), or indicators of persistence mechanisms (scheduled tasks, registry Run keys).
Detects attempts to disable audit logging features in Microsoft 365, specifically mailbox auditing (via Set-Mailbox) or unified audit log ingestion (via Set-AdminAuditLogConfig). Disabling these features can be a precursor to unauthorized activities, as it prevents the capture of user actions and administrative changes.
Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.
Detects HTTP requests attempting to access 'cmd.jar' on Cisco Firepower Management Center (FMC) devices, which is indicative of post-exploitation activity related to CVE-2026-20079, where an attacker may be attempting to retrieve or upload a command executor.
Detects an attempt to exploit CVE-2026-20079 in Cisco Firepower Management Center (FMC) by targeting the home.jsp file with a specific malicious parameter string indicating post-exploitation activity.
Page 2 of 8