Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects the execution of Microsoft Edge in headless mode with the '--print-to-pdf' argument, saving the output to a user's Public folder. This behavior can be indicative of malicious activity, as seen in the Horabot spreader.
This rule detects network communication (DNS queries, HTTP requests, or network connections) to the command and control (C2) domain 'checkmarx.zone', which is associated with the TeamPCP threat group. This activity indicates potential compromise or communication with adversary infrastructure.
Identifies suspicious URI request patterns potentially indicative of CVE-2026-4681 exploitation attempts against PTC PLM solutions. This rule looks for these specific patterns within web traffic logs from various sources (access logs, IIS, Apache).
Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.
Detects the execution of Microsoft Edge in headless mode with the '--print-to-pdf' argument, saving the output to a user's Public folder. This behavior can be indicative of malicious activity, as seen in the Horabot spreader.
Detects the execution of icacls.exe to grant 'Full Control' permissions to the 'Everyone' group for SimpleHelp RMM
Detects Microsoft Edge being utilized in headless mode to generate PDF files in the Public directory, a technique the Horabot spreader uses to create malicious attachments for phishing.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This would be communicating with a service that runs arbitrary commands.
Detects ELF binaries with suspicious capabilities for privilege escalation, such as shell execution and process capabilities
Detects the execution of cat, followed by network connections. Specifically /dev/tcp/ redirection
Page 27 of 38