nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,832 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
This rule detects outbound network connections from a device to a specific remote IP address (62.102.148.212) on a set of suspicious ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
Detects when a legitimate application, specifically 'pdf24.exe', loads 'cryptbase.dll' from a non-standard directory. This behavior is indicative of DLL side-loading, a technique known to be used by the PDFSIDER malware to evade detection and potentially escalate privileges.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with a file deletion command ('del', 'delete', or 'erase') using the '&' operator. This pattern can indicate an attempt to test network connectivity before or after performing a destructive action, often seen in malware or adversary scripts.
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. This rule specifically looks for instances where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' while the 'SenderMailFromDomain' (P1 envelope) is different, indicating an attempt to spoof the sender's domain.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a specific C2 domain (hellolargeworld.com:443) or invocation method (Extension.SubRoutine.Run2) within the PowerShell command line. The initiating process is expected to be 'node.exe'.
This rule detects the execution of suspicious processes ('servertool.exe' or 'encrypt.exe') on a device within 60 minutes of an inbound RDP connection being accepted. This could indicate an adversary establishing remote access and then deploying tools for further malicious activity, such as data exfiltration or encryption for ransomware.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an `AppData` directory.
Page 38 of 70