Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
Detects the creation of an executable named 'msbuild.exe' or its associated '.lock' file inside the Windows user Startup folder by Python or CI/CD processes. This technique was observed in the TeamPCP campaign compromising the Telnyx Python SDK, where a fake MSBuild binary was dropped for stealthy persistence and the lock file was hidden via 'attrib +h'.
Detects suspicious command-line arguments used with Windows utilities (LOLBAS), while excluding common legitimate Microsoft/Windows Update URLs.
Detects the execution of a renamed Python executable (csshost.exe) running Python scripts. This behavior is a known defense evasion technique associated with the PyLangGhost RAT, which is deployed by the NICKEL ALLEY threat group in their Contagious Interview campaigns.
The following analytic detects the execution of the 'gawk' command with elevated privileges on a Linux system. It leverages EDR telemetry to identify command-line execution data. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root.
Detects Windows registry run keys executing processes out of suspicious paths, for establishing persistence
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
This rule detects BITS job configuration files that exhibit characteristics of persistence mechanisms. It looks for the presence of BITS job structure elements, and sevral indicators suggesting abuse
Detects malicious/suspicious systemd generator files for persistence mechanisms
Detects malicious/suspicious systemd generator files for persistence mechanisms
Page 26 of 38