Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
This rule detects the execution of the 'awk' command on Linux/Unix systems when it is used with specific command-line arguments that indicate indirect shell execution.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation.
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
Detects log file modification followed by service manipulation to cover tracks.
Used /dev/null, therefore it acts as a stronger version of disable
Used /dev/null, therefore it acts as a stronger version of disable
This rule detects attempts to modify the SSH authorized_keys file, which can be used by adversaries to maintain persistence on a compromised system, using common utilities like echo, tee, cp, mv, python, or perl.
Detects cron job creation or edits that execute payloads from temporary or writable directories.
Rule looking for explorer and the user activity Reg Key indicating interactive commands, along with several malicious indicators around "clickfix" campaigns
Based off of BlueHammer Local Priv Escalation, exploiting Windows Defender's signature file handling
Detects PowerShell executable being copied to the ProgramData directory and renamed to 'wt.exe' (Windows Terminal) to masquerade as a legitimate binary. This is a documented defense evasion technique used by the Windows dropper for the Axios npm supply chain attack.
This rule detects the execution of package managers by common parent processes when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
Page 23 of 38