Tim P
@timdetections0 followers30 downloads10 copies6 likes500 views
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Categories
3
2
1
1
1
Platforms
3
1
1
Products / Services
1
1
1
1
MITRE Techniques
3
2
2
1
1
CVEs
1
Detects OAuth 2.0 device authorization grant requests utilizing the Microsoft Authentication Broker application ID (29d9ed98-a469-4536-ade2-f981bc1d605e) with sensitive scopes like 'https://graph.microsoft.com/.default'. This specific application ID is frequently impersonated by phishing kits (e.g., GhostCode) to facilitate token theft via device code flow abuse, where adversaries trick users into authenticating to a legitimate-looking but attacker-controlled flow.
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
Detects the Windows Server Update Services (WSUS) worker process (w3wp.exe) or service (wsusservice.exe) spawning command-line tools like cmd.exe or powershell.exe. This behavior is highly anomalous and strongly indicates a successful compromise, such as post-exploitation activity related to the WSUS Unauthenticated RCE (CVE-2025-59287).