Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects the execution of certutil.exe with command-line flag that can be used to interact with Active Directory Certificate Services, potentially for malicious purposes such as certificate theft or abuse.
Detects suspicious child processes (cmd.exe, cscript.exe, powershell.exe) spawned by Microsoft Outlook or Word. This behavior is often indicative of malicious activity, such as phishing attacks delivering malicious documents or emails that execute scripts or commands.
Hunting rule for "Dump Credential Manager using keymgr.dll and rundll32.exe" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.
Detects query of Software Inventory Logging collection state — defense evasion reconnaissance.
Based off of Atomic Red Team T1018 test "Remote System Discovery - adidnsdump" (Remote System Discovery) using command-line and process indicators derived from executor behavior.
Detects install-time commands from the Triple Cross eBPF rootkit deployer that attach a BPF
filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls
from kernel space to hide processes, files, and traffic while maintaining C2 access.
filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls
from kernel space to hide processes, files, and traffic while maintaining C2 access.
Using Shimache as source
File running from Recycle Bin
File running from Recycle Bin
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects abuse of legitimate Windows binary AgentExecutor.exe, executing powershell scripts. Correlation rule
Page 12 of 38