Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects malicious Message of the Day scripts for persistence
Detects usage udev rules launching at jobs or cron jobs for persistence
Detects suspicious cron job executions or the execution of a potentially trojanized 'crontab' binary. Adversaries, as seen with malware like Perfctl, may replace or modify the 'crontab' utility to hide malicious scheduled tasks from administrators. This detection looks for common patterns of malicious cron jobs.
Detects action of Repo branch protection being disabled by the means of a force push. This would mean no PR or review process is needed and an actor (Insider or attacker) could push arbitrary code.
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
The rule detects VNC (Virtual Network Computing) application usage on Windows systems, looking for specific indicators in conjunction.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
Detects the creation or modification of udev rules that execute suspicious commands or scripts from unusual locations. Udev rules are used by the Linux kernel device manager to handle hardware events and can be abused for persistence.
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Page 30 of 38