F S
@FsdrTrusted contributorCompletionist
10 followers128 downloads2,800 copies132 likes25,588 views
148 detections
Filters
Last updated
All Time
Detection languages
148
Categories
60
38
26
17
13
Platforms
112
20
15
15
13
Products / Services
95
20
17
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
This rule detects interaction with specific infrastructure identified as deceptive dating applications. It monitors network communication, sign-in attempts, email interactions, and endpoint execution associated with known malicious domains (e.g., archat.us, heyhru.com, sitin.ai), specific IP addresses (38.129.138.244), and unique package identifiers (com.cavalier.nalo, com.qiga.vio). The detection logic spans across DeviceNetworkEvents, EntraIdSignInEvents, EmailUrlInfo, EmailEvents, DeviceEvents, and DeviceProcessEvents to identify exposure to these Indicators of Compromise (IOCs) across both network and endpoint layers.
This rule monitors for network and email activity associated with known fraudulent AI reseller infrastructure. It aggregates data from device network connections, email URL inspections, and email header analysis to identify potential interactions with malicious domains known to facilitate AI-related fraud.
This rule detects when a DLL containing 'python' in its filename is loaded by a process that is not an identified Python interpreter or the dropbox.exe application. The rule specifically filters for these DLLs being larger than 10MB, which may indicate the use of embedded Python environments to facilitate malicious code execution or side-loading.
This rule monitors various logs (device network events, Entra ID sign-ins, cloud application events, and email events) for any interaction with a predefined list of indicator IP addresses identified as being associated with malicious actor egress traffic.
This rule detects activity matching known indicators of compromise (IOCs) associated with recent Russian espionage campaigns, including malicious domains, IP addresses, email senders, file names, and file hashes. It monitors network, sign-in, email, process, and file events across enterprise systems.
Detects network connections to known remote tunneling and relay services (e.g., ngrok, Cloudflare Tunnel) initiated by commonly abused LOLBins or processes running from user-writable directories. This behavior is often indicative of an adversary establishing persistent remote access or egress channels for command-and-control communication.
KQL Query
This rule detects potential indicators of compromise related to the 'ATodaPotencia' campaign by monitoring email URL logs, process command-line arguments, and general device events for the string 'ATodaPotencia'. The rule searches across multiple data sources to identify where this specific handle or artifact appears within an environment.
Detects outbound network connections from endpoints to domains and IP addresses associated with the Kimsuky (APT43) threat actor group. This rule leverages endpoint network telemetry to identify potential command and control (C2) communication or data exfiltration activities.
KQL Query
Page 3 of 15