Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,080 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows LogOff Button". Correlate before alerting on.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Modify Registry of Current User Profile - cmd". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows LogOff Button". Correlate before alerting on.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule based off of T1112 technique "Modify Registry of Local Machine - cmd". No public in-the-wild intel reference available; correlate before alerting.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects the execution of certutil.exe with command-line flag that can be used to interact with Active Directory Certificate Services, potentially for malicious purposes such as certificate theft or abuse.
Detects the execution of certutil.exe with command-line flag. that can be used to interact with Active Directory Certificate Services, potentially for malicious purposes such as certificate theft or abuse.
Hunting rule: correlate with additional signals before alerting.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Page 8 of 38