Sotiris Mavrakis
@smavrakisCompletionist
0 followers60 downloads147 copies4 likes12,642 views
8 detections
Filters
Last updated
All Time
Detection languages
7
1
Categories
4
3
2
2
2
Platforms
7
1
Products / Services
5
1
1
1
1
MITRE Techniques
4
3
2
2
2
CVEs
1
This rule detects suspicious command-line patterns indicative of obfuscation, encoding, or stealth techniques often used by adversaries. It scores various characteristics such as hidden window styles, variable manipulation, string operations, and decoding functions (e.g., Base64, Gzip, Deflate). The rule filters out known legitimate processes and command-line boilerplate to reduce false positives and classifies detections based on the highest scoring obfuscation category.
This rule detects the execution of common accessibility tools (osk.exe, powershell.exe, pwsh.exe, cmd.exe, reg.exe) with command-line arguments indicating an attempt to modify or leverage Windows accessibility features for persistence or privilege escalation. Specifically, it looks for command lines referencing 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility' and 'ATConfig\osk' or 'Accessibility\Session'. This behavior is often associated with adversaries attempting to maintain access or elevate privileges by manipulating accessibility programs like the On-Screen Keyboard.
This rule detects suspicious PowerShell activity that involves hidden windows, execution policy bypass, and attempts to download or execute files. It specifically looks for PowerShell processes launched by common parent processes like explorer.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, or rundll32.exe, combined with command-line arguments indicative of stealthy execution and payload delivery. The rule identifies two main scenarios: 'Hidden Downloader and Execution' where PowerShell is used with hidden window styles and download commands, and 'Inline Launcher and Payload Delivery' where PowerShell is used with no profile and download/execution commands.
This rule detects potential network beaconing activity by analyzing network connection events. It identifies repetitive outbound connections from a device to a remote IP and port with a consistent time interval (low jitter). The rule filters out known legitimate processes and domains to reduce false positives. It calculates the average time delta between connections, standard deviation, and interquartile range to identify beacon-like patterns. The rule also considers the number of unique devices connecting to the same remote endpoint to identify potentially compromised infrastructure.
Detects the creation of a suspicious scheduled task named "CaptureService" that is set to run every 11 minutes. This specific combination of task name, frequency, and executable (rundll32.exe) is indicative of a known persistence technique.
RDP Nesting
KQL
Identifies when an RDP connection is made to a first system and then an RDP connection is made from the first system to another system with the same account within the 60 minutes. Additionally, if historically daily
RDP connections are indicated by the logged EventID 4624 with LogonType = 10
RDP connections are indicated by the logged EventID 4624 with LogonType = 10
Detects potential exploitation attempts of the SharePoint vulnerability CVE-2025-53770 by looking for POST requests to ToolPane.aspx with a specific referrer.
Detects suspicious PowerShell execution via cmd.exe spawned by w3wp.exe (IIS worker process),
using encoded payloads that decode to indicators like 'spinstall0', '.aspx', or SharePoint layouts paths.
This technique has been observed in post-exploitation of SharePoint CVEs (CVE-2025-53770).
using encoded payloads that decode to indicators like 'spinstall0', '.aspx', or SharePoint layouts paths.
This technique has been observed in post-exploitation of SharePoint CVEs (CVE-2025-53770).