nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
This rule detects suspicious execution of wscript.exe or cscript.exe that involves VBScript or VBE files and contains keywords commonly associated with financial documents or urgent notifications in the command line. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating phishing attempts or malware execution.
Detects attempts to read the 'Groups.xml' file within the SYSVOL share. This file can contain sensitive credential information if Group Policy Preferences were used to deploy local user accounts or services, as the passwords might be stored in a decryptable format. Adversaries often target this file to extract credentials.
This rule detects the execution of iptables or xtables commands to create a network redirection rule. Specifically, it looks for commands that use 'REDIRECT', '--to-ports', and either 'PREROUTING' or 'nat' in the command line, indicating an attempt to redirect network traffic, potentially for proxying or other malicious network manipulation.
This rule detects multiple executions of VBScript or VBE files via wscript.exe or cscript.exe within a one-hour window, where the command line contains keywords commonly associated with malicious documents or phishing attempts (e.g., 'Invoice', 'Bill', 'Urgent', 'Payment'). This behavior can indicate user execution of a malicious script, often delivered via phishing.
Detects the execution of known privilege escalation tools such as SweetPotato, JuicyPotato, RoguePotato, PrintSpoofer, and BadPotato. These tools are commonly used by attackers to escalate privileges on compromised Windows systems.
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is associated with the 'protocal.cjs' backdoor from the easy-day-js supply chain attack, which aims to exfiltrate sensitive browser data.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the executed file name.
Detects the execution of wscript.exe or cscript.exe (Windows Script Host) from a parent process that is not commonly associated with legitimate script execution. This can indicate malicious script execution, potentially bypassing security controls or being part of an initial access or execution chain. Exclusions are made for common legitimate parent processes like explorer.exe, cmd.exe, powershell.exe, svchost.exe, system.exe, and web browsers.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, potentially by manipulating process arguments to mimic system processes.
Page 45 of 70