nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects exploitation of CVE-2026-24061, an authentication bypass in GNU telnetd, where the 'login' process is spawned with the '-f' flag to skip authentication and gain root access.
Detects successful brute force attacks: 10+ login failures within 10 minutes followed by successful login within 1 hour, excluding trusted networks and whitelisted accounts
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
Detects the Notepad++ updater (GUP.exe) spawning child processes with suspicious names (update.exe, install.exe, AutoUpdater.exe) from the Local Temp directory. This behavior was a primary vector for all three execution chains identified in the Notepad++ supply chain attack.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects anomalous Exchange Transport Rule activity: high volume changes, suspicious patterns, or after-hours modifications
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
Detects potential exploitation of Apache bRPC command injection vulnerability (CVE-2025-60021) via the /pprof/heap endpoint.
This rule detects Office applications (Word, Excel, PowerPoint) or Windows Explorer making outbound WebDAV connections to external, non-private IP addresses on standard web ports (80, 443). This behavior is associated with exploitation of vulnerabilities like CVE-2026-21509, potentially by threat actors such as APT28, to force authentication or exfiltrate data.
Detects an unusual exfiltration technique where a URL, typically from temp.sh, is embedded within the User-Agent string of an HTTP request. This TTP was observed in the Notepad++ supply chain attack in 2025 for exfiltrating system information.
Page 62 of 70