nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,828 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
Detects modifications to the 'Authentication Packages' registry key that include a '.dll' file. Adversaries may abuse authentication packages to execute DLLs when the system boots, establishing persistence and potentially escalating privileges.
Detects known MonsterV2 malware samples based on their SHA256 file hashes. Detecting these hashes on endpoints can directly identify MonsterV2 infections.
Detects Covenant Grunt Stager modules used by APT28 in the Phantom Net Voxel campaign based on known file hashes.
This rule detects attempts to disable PowerShell history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle' set to 'SaveNothing'. This technique can be used by adversaries to hinder forensic analysis and hide their command execution history.
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
Page 34 of 70