nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the modification of the 'fDenyTSConnections' registry key using 'reg.exe' to force-enable Remote Desktop Protocol (RDP) on a system, followed by an immediate connection attempt to port 3389. This behavior is indicative of an adversary or RMM-based tool attempting to establish unauthorized remote access for lateral movement.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
This rule detects network connections to Discord's API webhooks endpoint, specifically looking for POST requests. This activity can indicate data exfiltration, command and control communications, or other malicious use of Discord webhooks by adversaries.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Identifies the execution of wget.exe or curl.exe with command-line flags indicative of file uploads (specifically archives like zip, rar, or 7z), which may be used by adversaries to exfiltrate staged data to remote infrastructure.
Detects execution of a Python runtime loading a compiled bytecode file disguised with a '.cat' extension, a key defense evasion technique of NarwhalRAT.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe, a technique used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule identifies activities such as sideloaded app installations, which can bypass standard vetting processes and serve as a persistence mechanism for attackers. It also flags custom app creation outside of typical development teams, which could indicate the deployment of command and control (C2) bots or data exfiltration applications. Additionally, the rule looks for the addition of bots to teams and suspicious keywords in app names that might suggest impersonation or malicious tooling.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
Page 17 of 70