nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects when a web browser or the Dropbox client accesses a file that is potentially sensitive, based on file name or security labels. This may indicate unauthorized data exfiltration of HBI (Highly Business-Impact) data to a personal or public Dropbox account.
Detects potential fraud: New payment card added, followed by deposit and large withdrawal (>500) within 24 hours
Apt28 Cloud Storage C2
YARA-L
Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.
Detects process injection (e.g., process hollowing, remote thread creation) into legitimate OneDrive processes. Info-stealers use this technique to mask C2 communication as legitimate cloud traffic, bypassing network-based defenses.
Detects the creation of a directory junction pointing to a OneDrive synchronization folder. This is a key component of the 'DoubleDrive' technique, used to force the synchronization of arbitrary local files for data exfiltration or cloud-based ransomware encryption.
Detects DNS lookups to known Out-of-Band Application Security Testing (OAST) domains. These are often used by attackers to verify successful exploitation of vulnerabilities like SSRF or RCE.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Detects the creation of files with an imphash associated with UKC-1230 (Comburglar) malware. This imphash is a high-fidelity indicator for the surrogate DLLs used in their COM hijacking persistence technique.
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
Detects when a new Multi-Factor Authentication (MFA) method is registered shortly after a successful sign-in from an unfamiliar or risky location. This pattern is a strong indicator of an Adversary-in-the-Middle (AiTM) attack where the threat actor, having bypassed MFA to gain initial access, immediately adds their own authentication method to establish persistence on the account.
Page 67 of 70