nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the specific vssadmin command used by VECT ransomware to silently delete all volume shadow copies. Shadow copy deletion is a critical precursor to ransomware impact, effectively removing localized backup recovery options.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
This rule detects attempts to delete volume shadow copies using 'vssadmin.exe' or 'wmic.exe' with specific command-line arguments. This activity is often associated with ransomware or other destructive malware aiming to inhibit system recovery. The rule explicitly excludes commands containing 'backup' to reduce false positives.
This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.
This rule detects login events with a high-risk score (0.8 or greater) as determined by the 'castle' log source. It normalizes event and risk fields to ensure consistent detection.
Detects regsvr32.exe executing with command-line arguments that indicate an attempt to download and execute a scriptlet from a remote HTTP/HTTPS source. This technique, often referred to as 'Squiblydoo', is used to bypass application control and execute malicious code.
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Detects PowerShell processes executing commands that include base64 decoding (FromBase64String), invoking expressions (IEX), creating web client objects (New-Object Net.WebClient), and making HTTP/HTTPS requests. This combination is often indicative of malicious PowerShell activity, such as downloading and executing payloads from remote servers, potentially obfuscated.
This rule detects when an executable (.exe) is launched from the AppData\Roaming directory. This directory is often used by legitimate applications, but it is also a common location for malware to drop and execute itself. The rule excludes processes related to OneDrive and Teams to reduce false positives.
Page 54 of 70