nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects network connections initiated by 'Browser_Updater.exe' to a known malicious IP address (45.251.243.210) or a specific domain containing 'iis.jpg'. This activity is indicative of initial access or command and control related to a specific campaign.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The detection specifically looks for the task name 'SoftwareProtection', a command line containing 'python.exe', 'pythonw.exe', or 'run.exe' along with 'udp.pyw', and the path '\windows\SoftwareProtectionPlatform\', indicating the malware's attempt to masquerade as a legitimate system component.
Detects procdump execution targeting lsass.exe
A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects network connections to known malicious domains or IP addresses associated with Fortinet or Ivanti VPN phishing campaigns or command and control infrastructure. This rule identifies attempts to connect to fake VPN portals or communicate with adversary-controlled servers.
This rule detects the execution of common remote execution and lateral movement tools by monitoring process command lines for specific keywords. The tools include pth-winexe, crackmapexec, impacket, smbexec, and wmiexec, which are frequently used by adversaries for remote code execution and network reconnaissance.
This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects programmatic file downloads from SharePoint and OneDrive using automation tools like PowerShell, PnP, Graph SDK, Python, Node.js, or generic CLI tools (curl, wget) rather than typical browser access. This can indicate data exfiltration.
Page 21 of 70