nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects instances where 'node.exe' executes 'protocal.cjs' from a 'NodePackages' path and subsequently spawns child processes that perform host reconnaissance activities. These activities include PowerShell registry queries, process listing, and querying installed applications, which are indicative of an adversary gathering system information.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern can indicate an attempt to test network connectivity before performing a destructive action, often seen in malware or adversary scripts.
This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific whitespace indicators. This combination could indicate an attempt to interact with or exploit older network protocols or systems, potentially for reconnaissance or data exfiltration.
Detects the creation or modification of a registry run key that uses a name similar to '.NET Runtime Optimization Service' and points to a suspicious location within 'C:\ProgramData\'. This technique is often used by adversaries to establish persistence on a system by masquerading as legitimate software.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. Threat actors use this for rapid lateral movement.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
Detects a script process creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the executed file.
Page 51 of 70