nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,828 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Identifies instances where a user account established an interactive logon session from a known RedVDS IP address and subsequently executed PowerShell commands containing download patterns (Net.WebClient or DownloadString), indicative of secondary payload retrieval.
Detects modification of scripts in extension folders.
Detects creation of Remcos RAT keylogger output file AppData\Roaming\DT\logs.dat by a non-browser process or a browser process indicating process hollowing
Detects HKCU/HKLM Run key write whose registry_value_data points to an executable under AppData\Roaming, correlated with a FILE_CREATION of that executable on the same host within 5 minutes. Consistent with the TuglaInsaatci steganographic loader dropping a randomly-named copy of itself (e.g. dEprjIuLKcEd.exe) to AppData\Roaming and registering it for autorun.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects network connections using the GRE (Generic Routing Encapsulation) protocol destined for non-internal (outside of RFC 1918) IP addresses. GRE is frequently used for tunneling traffic and, when used to communicate with external hosts, may indicate unauthorized tunneling or data exfiltration.
This rule monitors for Generic Routing Encapsulation (GRE) network traffic originating from or destined to non-private (non-RFC1918) IP addresses. GRE is often used for tunneling protocols and can be abused to bypass network security controls or establish hidden command and control communication channels.
Detects the creation of a scheduled task by the Potemkin Loader using the 'schtasks.exe' utility. The rule specifically looks for command lines containing task creation flags combined with an executable path located within 'AppData' directories, which is a common persistence mechanism for this loader.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
Page 40 of 70