Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads950 copies13 likes34,079 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects network commands executed from suspicious directories.
Loose Sigma equivalent to SPL Detection at https://detections.ai/rules/019b06c7-03a3-72ac-a9c8-11b0482d8db7
Loose Sigma equivalent to SPL Detection at https://detections.ai/rules/019b06c7-03a3-72ac-a9c8-11b0482d8db7
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects processes contacting multiple different domains (potential network enumeration OR C2 rotation)
This requires correlation engine of some kind.
Logic: Same user/host contacts 5+ different domains in 10 minute span
This requires correlation engine of some kind.
Logic: Same user/host contacts 5+ different domains in 10 minute span
Detects a host initiating network connections to multiple unique domains within a short time frame using common tools and interpreters.
This can be indicative of C2 channel rotation, or network enumeration.
This rule is excluding certain cloud metadata services.
This rule requires a correlation engine to aggregate events over time.
This can be indicative of C2 channel rotation, or network enumeration.
This rule is excluding certain cloud metadata services.
This rule requires a correlation engine to aggregate events over time.
Behavior is tied to enumeration of network services, relating to the discovery tactic.
Where "network_connection_discovery`"is a lookup table of “ifconfig.me” and related services
Where "network_connection_discovery`"is a lookup table of “ifconfig.me” and related services
Page 38 of 38