F S
@FsdrTrusted contributorCompletionist
10 followers128 downloads2,800 copies132 likes25,588 views
148 detections
Filters
Last updated
All Time
Detection languages
148
Categories
60
38
26
17
13
Platforms
112
20
15
15
13
Products / Services
95
20
17
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
Detects external consumer Microsoft Teams accounts (live: accounts) attempting to impersonate internal organization employees by matching display names or swapped first/last names against internal identity records.
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
This rule aggregates software inventory, vulnerability assessments, network connection events, and exposure graph data to prioritize patching and identify internet-facing devices running PHP with known vulnerabilities or active web listeners.
Detects the presence of known malicious or suspicious OAuth application IDs as well as specific third-party applications like SkyKick or ConnectWise within OAuth application metadata over a 30-day window.
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects sign-in events to Entra ID via service principals where the application is marked as external and enabled, and the user agent string indicates the use of a Python client.
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
Page 1 of 15