nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging, temporary file execution, or attempts to clean up forensic evidence.
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' within the RemoteUrl field, which often indicates communication with a C2 server using a UUID-like identifier.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' allows tunneling into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule correlates multiple 'storage.objects.list' and 'storage.objects.get' operations within a one-hour window from the same identity, bucket, and project, flagging activity exceeding 50 operations.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
Page 28 of 70