Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects multiple methods used by adversaries to clear or disable Linux
shell command history (bash, zsh) in order to cover tracks and evade investigation.
shell command history (bash, zsh) in order to cover tracks and evade investigation.
Detects methods used by adversaries to clear or disable Linux shell command history (bash or zsh) in order to cover tracks and evade investigation.
Regex based Rule for burntcigar malware
Detects PowerShell command lines that exceed a certain length of characters or more, which may indicate obfuscated or automated malicious activity. It also specifically looks for common PowerShell download and execution patterns within the command line.
Detects PowerShell command lines that exceed a certain length of characters or more, which may indicate obfuscated or automated malicious activity. It also specifically looks for common PowerShell download and execution patterns within the command line.
Detects ClickFix-style PowerShell payloads based on command-line patterns and fake error prompts.
`This rule looks for API calls that stops logging for CloudTrail Lake channels and a trail configuration.
These actions would prevent logging of CloudTrail logs from the time of API call.
These actions would prevent logging of CloudTrail logs from the time of API call.
Looking for changes of remiving the delivery channel or configuration recorder for AWS Config.
Indicative of defense evasion or someone covering their tracks.
This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic.
Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
Indicative of defense evasion or someone covering their tracks.
This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic.
Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
This detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects events in Okta where there is the eventType of ~'policy.lifecycle' and the policy of 'OktaSignOn'.
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
Page 37 of 38