Tun Tun Naing
@tuntunCompletionist
1 follower11 downloads270 copies3 likes7,894 views
19 detections
Filters
Last updated
All Time
Detection languages
19
Categories
5
1
1
1
Platforms
16
2
Products / Services
2
1
MITRE Techniques
3
3
3
1
1
CVEs
3
3
3
2
1
Query looks for non-root users launching the switch user (su) process via a parent process other than the normally expected processes such as shells, sudo, or su itself.
Query looks for potential CopyFail proof of concept (POC) code execution via identifying potentially correlated curl and su process executions. May identify false positives, yet works well for identification of CopyFail POC provided by Xint.Code.
KQL Query
KQL Query
KQL Query
KQL Query
Detects indicators associated with the axios npm supply chain compromise by identifying suspicious payload execution (wt.exe in ProgramData) and persistence via the Windows Run registry key (MicrosoftUpdate). The rule triggers when either behavior is observed, providing visibility into potential post-compromise activity on Windows endpoints.
Detects potential TA585 / MonsterV2 command-and-control (C2) behavior linked to the ClickFix campaign. This rule identifies hosts that first contact api.ipify.org (used by malware to determine external IP) and subsequently connect to a non-private IP on port 7712 or known TA585 C2 infrastructure, indicating possible beaconing activity after initial reconnaissance.
Detects suspicious OAuth app consents, role assignments, and group changes involving Workday and Salesforce, indicating potential account compromise or privilege escalation.
Page 2 of 2