nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the execution of CbsMsgApi.exe, which is the initial loader used by the REF4033 group to install the BADIIS IIS module and create a persistence service. The detection is based on the specific filename or the known MD5 hash of the loader.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects attempts to stop or clear Windows Event Logs using command-line utilities such as 'sc', 'net', or 'wevtutil'. This activity is often performed by adversaries to remove forensic evidence of their actions.
This detection identifies when a Managed Identity (Service Principal) executes a 'RunCommand' on a virtual machine. This activity is a key indicator of lateral movement, where an attacker, having compromised a resource with a Managed Identity, uses that identity's permissions to execute code on another VM.
This rule detects the execution of common remote execution and lateral movement tools by monitoring process command lines for specific keywords. The tools include pth-winexe, crackmapexec, impacket, smbexec, and wmiexec, which are frequently used by adversaries for remote code execution and privilege escalation.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects network connections to the Telegram API, specifically to the /sendMessage or /getUpdates endpoints. This activity can be indicative of command and control (C2) communication or data exfiltration using Telegram as a covert channel.
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Page 27 of 70