nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
This rule detects network connections using the GRE (Generic Routing Encapsulation) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration, especially when communicating outside of internal network ranges.
This rule detects network connections where an 'access_token=' string is present in the additional fields of network events, excluding common legitimate authentication domains like Google, Microsoft, and GitHub. This could indicate the exposure of sensitive access tokens over the network.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines indicate scheduled task registration via tools like 'schtasks', 'Register-ScheduledTask', or 'New-ScheduledTask' with the specific task name 'OneDrive Update'.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, indicative of NarwhalRAT staging.
This rule detects suspicious activity where a process attempts to access browser credential files (e.g., login data, cookies) shortly after a VPN logon event on the same device and by the same user. This could indicate an attacker attempting to steal credentials after gaining initial access or establishing a VPN connection.
This rule detects suspicious process command lines that indicate potential tunneling activity. It looks for commands containing 'tunnel', '--url', and '--logfile', while excluding legitimate 'cloudflared.exe' processes. This pattern is often used by adversaries to establish covert communication channels or exfiltrate data.
This rule detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement. The rule categorizes the detected tools into 'Tunneling' or 'RMM'.
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which can be observed in process command line executions.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe. This LOLBIN evasion technique is actively used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
Page 11 of 70