F S
@FsdrTrusted contributorCompletionist
10 followers128 downloads2,800 copies132 likes25,588 views
148 detections
Filters
Last updated
All Time
Detection languages
148
Categories
60
38
26
17
13
Platforms
112
20
15
15
13
Products / Services
95
20
17
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects suspicious activity where a non-browser process attempts to decrypt credentials stored by Google Chrome or Microsoft Edge using DPAPI (Data Protection API). This could indicate an adversary attempting to steal stored browser credentials.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects instances where dllhost.exe initiates outbound network connections to public IP addresses. Legitimate dllhost.exe processes rarely need to communicate with the internet. Such connections could indicate compromise through COM object hijacking, process hollowing, or injected code attempting to establish command and control (C2) communication.
Detects instances where dllhost.exe, which typically hosts COM objects, spawns suspicious child processes such as command shells, scripting interpreters, or reconnaissance tools. This behavior is highly indicative of COM object hijacking, process injection, or DCOM lateral movement with hands-on-keyboard activity.
KQL Query
This rule detects instances where 'dllhost.exe' is spawned by a parent process other than 'services.exe' or 'svchost.exe'. Dllhost.exe is typically used to host COM+ applications and should almost exclusively be initiated by these legitimate system processes. An unusual parent could indicate COM object hijacking, lateral movement, or process injection attempts.
Page 11 of 15