Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads950 copies13 likes34,079 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects svchost.exe masquerading or abnormal process lineage. Legitimate svchost.exe
runs from System32 or SysWOW64 and is launched by services.exe as the Service Control
Manager host process. Execution from user-writable paths indicates binary masquerading;
execution from script hosts or explorer indicates a rogue or attacker-controlled launch
rather than normal service startup.
runs from System32 or SysWOW64 and is launched by services.exe as the Service Control
Manager host process. Execution from user-writable paths indicates binary masquerading;
execution from script hosts or explorer indicates a rogue or attacker-controlled launch
rather than normal service startup.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions — the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects query of Software Inventory Logging collection state — defense evasion reconnaissance.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Hunting rule loosely based off of Atomic Red Team T1112 test "Modify registry to store logon credentials". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely based off of Atomic Red Team T1112 test "Modify registry to store logon credentials". No public in-the-wild intel reference available; correlate before alerting.
Page 7 of 38