Vignesh S
@vigneshhCompletionist
0 followers4 downloads18 copies0 likes99 views
8 detections
Filters
Last updated
All Time
Detection languages
8
Categories
5
3
2
1
1
Platforms
8
1
1
Products / Services
8
MITRE Techniques
4
3
2
2
2
Detects file write events occurring within users’ Downloads directories on Windows endpoints. The detection monitors file creation or write activity under C:\Users\<Username>\Downloads\ and captures relevant details, including hostname, username, file name, file path, company name, SHA-256 hash, and the originating process name.
This detection helps identify potentially suspicious downloads, unauthorized file transfers, and files that may require further investigation.
This detection helps identify potentially suspicious downloads, unauthorized file transfers, and files that may require further investigation.
This detection identifies outbound IPv4 and IPv6 network connections to non-standard ports that may indicate suspicious network activity, unauthorized communication, or potential command-and-control (C2) traffic.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
Detects the execution of the Tor executable or the launching of Tor Browser from Brave Browser. The detection also identifies command-line arguments associated with Tor configuration files and Control/SOCKS ports, providing visibility into potential Tor usage on Windows endpoints for further investigation.
Detects Windows Portable Executable (PE) files (.exe) written to common user profile directories, such as Desktop, Downloads, Documents, and other user profile folders that lack company name metadata. This activity may indicate potentially untrusted executables, dropped malware, or masquerading attempts in user-writable locations.
The detection may also identify legitimate software, portable applications, development tools, and other benign files.
The detection may also identify legitimate software, portable applications, development tools, and other benign files.
Detects Windows PE executable files written to disk with company metadata matching Sysinternals (Sysinternals - www.sysinternals.com). This detection identifies the presence of Sysinternals tools on endpoints for security monitoring and investigation.
Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious.
Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious.
Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
Detects the execution of processes associated with virtualization platforms, hypervisors, virtual machine management utilities, and containerization technologies on Windows endpoints.
The detection identifies executable names related to Microsoft Hyper-V, VMware, Oracle VirtualBox, QEMU, Xen, Parallels, WSL, and container runtimes such as Docker and containerd.
The detection identifies executable names related to Microsoft Hyper-V, VMware, Oracle VirtualBox, QEMU, Xen, Parallels, WSL, and container runtimes such as Docker and containerd.
Detects Portable Executable (PE) files written to users’ Downloads directories on Windows endpoints by identifying file signatures rather than relying on file extensions. This activity may indicate potential payload delivery, malware downloads, or legitimate user-initiated downloads. Review the file path, file name, company name, SHA-256 hash, and associated endpoint and user details to determine whether the file is suspicious.
Detects DLL files written to common Windows user directories, including Desktop, Downloads, Pictures, Videos, Documents, Music, and other user profile folders. These files may be written by archive extraction utilities such as Windows Explorer, 7-Zip, or WinRAR, web browsers during downloads, or other applications.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.