nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,819 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
This rule detects potential session token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in device identity (dtHash), operating system (OS), or client country within the same session, rather than just multiple IP addresses. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
Detects the execution of Visual Studio Code (code.exe or code-tunnel) with command-line arguments indicative of remote access, tunneling, or server functionality. This behavior can be legitimate for developers or IT administrators but may also be abused by adversaries for command and control or data exfiltration.
Detects the loading of 'mscoree.dll' or 'msvcp140.dll' from the 'C:\ProgramData\' directory by processes masquerading as '.NET Runtime Optimization Service' or originating from a highly suspicious, obfuscated folder path. This behavior is indicative of malware attempting to evade detection through DLL side-loading or process masquerading, as legitimate .NET Runtime Optimization Service processes should not load these DLLs from this location or from such unusual paths.
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
Device Code Phishing Attempt
Cortex XDR
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of a phishing attack where an adversary is trying to gain access to a user's application access token.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query string, which are indicators of the ErrTraffic webshell activity.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Detects Microsoft 365 OAuth access tokens issued via device_code grant — the mechanism abused by the EvilTokens phishing kit — followed within 1 hour by mailbox forwarding rule creation for the same account, indicating persistent BEC access post-compromise.
Detects potential UAC bypass activity involving the hijacking of the Event Viewer (eventvwr.exe) COM object. The rule monitors for registry modifications to the 'HKCU\Software\Classes\mscfile\shell\open\command' key, followed by the execution of 'eventvwr.exe' by a suspicious parent process, indicating an attempt to elevate privileges to perform arbitrary command execution.
Page 5 of 70