Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,080 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects Enumerating Stored Wi-Fi Profiles And Passwords via netsh (System Network Configuration Discovery: Wi-Fi Discovery) using command-line and process indicators derived from executor behavior.
Detects T1021.001 "Disable NLA for RDP via Command Prompt" (Remote Services: Remote Desktop Protocol) using command-line and process indicators derived from executor behavior.
Hunting rule for nmap used for internal network discovery.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, -iL target lists, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, -iL target lists, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.
Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.
Based off of Atomic Red Team T1018 test "Remote System Discovery - adidnsdump" (Remote System Discovery) using command-line and process indicators derived from executor behavior.
Detects 1027 test "Execute base64-encoded PowerShell from Windows Registry" (Obfuscated Files or Information) using command-line and process indicators derived from executor behavior.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects the execution of Procdump targeting the Local Security Authority Subsystem Service (LSASS) process. This activity is commonly associated with credential dumping, where an attacker attempts to extract sensitive authentication material (like passwords or hashes) from memory.
Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.
Page 10 of 38