nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex'.
Detects the execution of python.exe from the C:\Users\Public\ directory. Adversaries frequently use this technique by dropping a portable Python environment into a globally writable location to execute malicious scripts without requiring an official Python installation, often as part of information stealing malware payloads.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
This rule checks if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a GitHub repository and then uses KQL's `ipv4_is_in_any_range` and `ipv6_is_in_any_range` functions to determine if the provided IP address is part of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
This rule detects attempts to modify or delete Conditional Access Policies within Azure Active Directory (now Microsoft Entra ID) by monitoring network events targeting 'graph.microsoft.com' with 'conditionalAccessPolicies' in the AdditionalFields, specifically looking for 'PATCH' or 'DELETE' operations. Such activities could indicate an adversary attempting to weaken security controls or maintain persistence.
Page 22 of 70