Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads950 copies13 likes34,079 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects procdump execution targeting lsass.exe
Kind of like https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Kind of like https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Detects process creation for common RMM tools (AnyDesk, Bomgar/BeyondTrust, TeamViewer).
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
Detects credential dumping of the TermService svchost process that can retain plaintext
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
This rule detects the use of XOR encoding patterns in PowerShell command-line arguments. Adversaries frequently use XOR encoding or other obfuscation techniques within scripts to hide malicious commands or payloads from static analysis and security tools.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Detects execution or download activity tied to Nimbus Manticore (UNC1549) SEO
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
This rule detects the use of XOR encoding patterns in PowerShell command-line arguments. Adversaries frequently use XOR encoding or other obfuscation techniques within scripts to hide malicious commands or payloads from static analysis and security tools.
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Page 1 of 38