Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,080 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects process creation for common RMM tools (AnyDesk, Bomgar/BeyondTrust, TeamViewer).
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
Detects command injection related attacks with AI agents through suspicious prompt patterns or system command execution by AI processes.
Detects the deletion of Kubernetes log events, which could indicate an attempt at defense evasion or covering tracks by an attacker. The rule looks for 'delete' operations on 'Event' resources while excluding actions by 'ci-admin*' or 'system:*' users to reduce false positives.
Detects ClickFix PowerShell payloads
Using a variety of known Command Patterns and Fake Messages
Using a variety of known Command Patterns and Fake Messages
Detects procdump execution targeting lsass.exe
A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
The following rule detects attempts to tamper with Linux log records by looking for interpreter processes, or common utility commands interacting with critical log files such as /var/log/wtmp, /var/log/btmp, or /var/run/utmp. It also includes scenarios where 'dd' or 'cp' might be used with /dev/null or /dev/zero to effectively clear or overwrite log content.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware
to bypass Transparency, Consent, and Control (TCC) restrictions.
to bypass Transparency, Consent, and Control (TCC) restrictions.
Detects activity where there are role bindings and high-risk actions (verbs) applied.
This could be indicative of Privilege Escalation.
This could be indicative of Privilege Escalation.
Detects DLL side-loading attacks using legitimate security software binaries (but often targeted)
to execute malicious DLL payloads, covering various security vendors commonly abused.
to execute malicious DLL payloads, covering various security vendors commonly abused.
Detects interactive shell execution within a container in a production Kubernetes namespace, using the 'exec' command.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Page 35 of 38