F S
@FsdrTrusted contributorCompletionist
10 followers128 downloads2,800 copies132 likes25,588 views
148 detections
Filters
Last updated
All Time
Detection languages
148
Categories
60
38
26
17
13
Platforms
112
20
15
15
13
Products / Services
95
20
17
14
4
MITRE Techniques
47
42
33
21
20
CVEs
1
1
1
KQL Query
Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.
KQL Query
This rule identifies rare web browser extensions installed on Chrome or Edge browsers by monitoring file events for low-prevalence extension IDs. An extension is considered rare if it has been observed on fewer than 3 devices within the last 30 days. This pattern is often used to detect malicious or unauthorized extensions, which can be leveraged for persistence or credential theft.
KQL Query
KQL Query
KQL Query
KQL Query from file: client.dll sideload hunt - user-writable and staging paths only (steam dll inpersonatin)
Detects network connections to uncommon or suspicious top-level domains (TLDs) initiated by processes other than standard web browsers. The rule filters out known browser processes and analyzes network traffic patterns, including connection count and prevalence across the fleet, to identify potentially anomalous or malicious C2 activity.
Detects the use of PowerShell commands 'irm' (Invoke-RestMethod) or 'iwr' (Invoke-WebRequest) to download content from a direct IP address. This pattern is commonly used by attackers to stage malicious payloads or tools directly from external infrastructure, bypassing domain-based reputation filters.
Page 6 of 15