Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects Windows registry run keys executing processes out of suspicious paths, for establishing persistence
Detects scripts modifying Windows registry run keys for establishing persistence
Detects lateral tool transfer activities using common utilities like scp, rsync, wget, or curl, combined with an IP address in the command line and a script/executable file. This pattern is often indicative of an attacker moving tools between compromised systems.
Detects active SSH session takeover attempts.
When the process of one user accesses another user's SSH agent
When the process of one user accesses another user's SSH agent
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
Detects active SSH session takeover attempts.
Watching for common terminal multiplexing utilities attaching to sessions.
Watching for common terminal multiplexing utilities attaching to sessions.
This rule detects attempts to transfer tools or other files between systems in a compromised environment using common utilities like scp, rsync, wget, or curl. This rule should be used for hunting in your environment.
Detects the creation of new user accounts on Linux systems using the 'useradd' command with parameters that grant root (UID 0 or GID 0) privileges, or prevent home directory creation, which can indicate a backdoor account.
Detects action of git clone or git push in a repo where the source actor is not coming from a Corp IP Space. (Add your IP Blocks as needed to the filter)
Detects action of Repo branch protection being disabled. This would mean no PR or review process is needed for that repo and an actor (Insider or attacker) could push arbitrary code. Bypassing usual Security controls.
Page 32 of 38