nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects DNS resolution requests for the known Nexcorium C2 domain. The Nexcorium Mirai variant relies on this command-and-control server to receive attack parameters for large-scale DDoS campaigns.
Detects the execution of mshta.exe with command-line arguments indicating it is loading a script (VBScript, JavaScript) or a URL. This behavior is commonly abused by adversaries for code execution and bypassing application controls.
Detects the use of wmic.exe to create a new process. This can be indicative of an adversary using WMI for execution.
This rule detects the execution of PowerShell with encoded commands. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for 'powershell.exe' in the process filename and either '-enc' or '-encodedcommand' in the command line, while excluding known legitimate uses by 'Windows Defender'.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
This rule detects when a Microsoft Office application (Word, Excel, PowerPoint) spawns a command interpreter (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute commands on the system.
This rule detects the use of specific Linux environment variables (LD_AUDIT, LD_DEBUG, LD_DEBUG_OUTPUT) in command lines. These variables can be abused for dynamic-link library (DLL) injection or other forms of process injection, allowing adversaries to execute arbitrary code or debug processes in a way that might bypass security controls.
This rule detects the creation, patching, or updating of Kubernetes 'clusterrolebindings', 'rolebindings', or 'roles' within 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce false positives related to legitimate system operations. This activity could indicate an attempt to escalate privileges or establish persistence within critical Kubernetes environments.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary code execution.
Detects instances where 'notepad.exe' is executed from the 'Microsoft.WindowsNotepad' directory within 'Program Files\WindowsApps' and attempts to open a markdown (.md) file. This could indicate unusual activity or potential abuse of the Notepad application, especially if the version is not '11.2510'.
Page 55 of 70