Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects WMI abuse for lateral movement, remote execution, and persistence
Detects assignment of highly privileged directory roles in Azure AD, including
Global Administrator and Privileged Role Administrator.
Global Administrator and Privileged Role Administrator.
Process Data as source
File running from Recycle Bin
File running from Recycle Bin
Detects lateral movement attempts using SMB administrative shares
Hunting rule for Atomic Red Team T1003 test "Send NTLM Hash with RPC Test Connection" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
This rule detects the execution of package managers by common parent processes (code.exe, cmd.exe, powershell.exe) when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
Page 13 of 38