Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,080 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects suspicious command lines executed via the Windows Run dialog that combine DNS lookup commands commonly seen in ClickFix-style staging activity.
An expansion of https://detections.ai/rules/019c774e-8cbc-70b0-91d6-3d2fb93c5a00
An expansion of https://detections.ai/rules/019c774e-8cbc-70b0-91d6-3d2fb93c5a00
Detects creation of malicious init.d scripts for persistence
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
Detects successful content injection leading to process execution
Hunts for unusual external SSH access patterns indicating Technique T1133
Hunts for unusual external SSH access patterns indicating Technique T1133
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
Detects DLL side-loading attacks using legitimate security software binaries (but often targeted)
to execute malicious DLL payloads, covering various security vendors commonly abused.
to execute malicious DLL payloads, covering various security vendors commonly abused.
Detects JavaScript-based drive-by compromise execution
Detects activity related to Network Discovery.
Here, one group of network commands has to match for the rule to trigger.
Here, one group of network commands has to match for the rule to trigger.
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
Page 34 of 38