Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
Detects execution or download activity tied to Nimbus Manticore (UNC1549) SEO
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
Sudo Caching and Elevation Abuse
Gravwell
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
Detects assignment of highly privileged directory roles in Azure AD, including
Global Administrator and Privileged Role Administrator.
Global Administrator and Privileged Role Administrator.
Detects processes launched with LD_AUDIT or LD_DEBUG style dynamic linker instrumentation, sometimes used to weaken execution guardrails or enable stealthy code paths.
AppArmor Profile Removed
Cortex XDR
This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
Detects ELF binaries with suspicious capabilities for privilege escalation, such as shell execution and process capabilities
Detects modified PAM modules or ELF files implementing PAM backdoors for credential interception, as seen in Ebury and QLNX, whihc uses Rootkit techniques.
Detects deletion of Kubernetes events in audit logs when the request completes successfully.
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
macOS dscl User Creation
Gravwell
Detects the creation of local user accounts on macOS using the 'dscl' utility, specifically looking for the '-create' action within the '/Users/' directory and the presence of 'UniqueID' or 'IsHidden' parameters. The rule excludes common system-related UniqueIDs (0, 1, 202, 205, 248) to reduce false positives from legit system operations.
Page 17 of 38