Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Attempts to discover running processes on a Windows system using either native utilities or PowerShell commands/API calls. Adversaries often use these methods to gain information about running processes as part of discovery.
Hunting rule, not a drop in detection
Hunting rule, not a drop in detection
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects setting IsHidden on a macOS user record to suppress the account from the login screen.
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Detects the creation of local user accounts on macOS using the 'dscl' command-line utility, specifically looking for the '-create' action within the '/Users/' directory and the presence of 'UniqueID' or 'IsHidden' parameters. The rule excludes common system-related UniqueIDs (0, 1, 202, 205, 248) to reduce false positives from legit system operations.
Detects the use of the `sysadminctl` utility with the `addUser` or `-addUser` command-line arguments, which can be used to create new user accounts on macOS systems. This activity could indicate an adversary attempting to establish persistences by creating new accounts.
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
Detects the use of the 'setcap' utility with parameters that assign all Linux capabilities to a binary file. This capability can be abused to create a backdoored binary, enabling unauthorized access, privilege escalation, and bypassing security controls.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Detects commands writing to authorized_keys files, a common SSH persistence method.
Page 14 of 38