Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,080 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Hunts for unwarranted hardware additions through USB device connections in macOS Unified Logs. In an environment where USB devices are not permitted.
In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
Detects action of SSH ertificate Auth being disabled. This would mean password auth is allowed.
This could indicate an Authentication downgrade attack, disabling Security controls.
This could indicate an Authentication downgrade attack, disabling Security controls.
Detection attempts to modify package manager configurations to point to potentially malicious repositories, enabling supply chain attacks through dependency confusion.
This rule detects the execution of multiple common network discovery commands within a short time frame. This behavior can indicate reconnaissance activities aimed at understanding network topology, identifying active hosts, and discovering network services.
Rule to detect where there are role bindings and high-risk actions (verbs) applied within production or default namespaces. This rule specifically looks for these high-risk actions (verbs), excluding actions by the 'system:clusterrole-aggregation-controller' user, which is a legitimate system process.
Hunts for modifications to RC initialization scripts. This could point to persistence
Detects creation of backdoor accounts with high privileges such as root.
Detects abuse of uncommon DNS record types for tunneling (CNAME, MX, NULL)
Detects a high count of DNS queries from a single source IP to a specific query name, indicating potential C2 beaconing.
Hunts for unwarranted hardware additions through USB device connections. In an environment where USB devices are not permitted.
Page 33 of 38