Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,194 copies871 likes151,520 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
https://blog.checkpoint.com/research/iran-nexus-password-spray-campaign-targeting-cloud-environments-with-a-focus-on-the-middle-east/
KQL Query
Detects presence of X-Antibot-Token header in HTTP requests
Detects presence of X-Antibot-Token header in HTTP requests
This rule detects inbound emails from 'azure-noreply@microsoft.com' that are delivered to the inbox, are the first contact from this sender, and contain specific keywords in the subject line such as 'severity', 'activated', 'deactivated', 'alert', 'invoice', 'payment', 'order', or 'fund'. This could indicate phishing attempts or social engineering using a spoofed Microsoft sender to deliver urgent or financially-themed messages.
This rule detects suspicious device registration activity in Microsoft 365. It correlates users who have recently visited Microsoft device login or OAuth2 device authentication URLs with subsequent device registration events in Azure AD. This could indicate an adversary attempting to register a new device to bypass MFA or gain persistent access, potentially through device code phishing.
This rule detects suspicious network connections to api.telegram.org from processes masquerading as legitimate Windows executables (MicDriver.exe, Winappx.exe, MsCache.exe, RuntimeSSH.exe, smqdservice.exe). It also identifies files with MD5 hashes matching known Indicators of Compromise (IOCs) from an external list. This combination suggests potential malware activity, possibly involving Telegram for command and control or data exfiltration, combined with process masquerading for evasion.
This rule detects inbound emails with an SVG attachment that is disguised as an HTML file and contains a long, base64-like string in its filename. This pattern is often used in phishing campaigns to bypass traditional email filters and deliver malicious content, potentially leading to credential harvesting or malware delivery. The rule specifically looks for files with a '.svg' extension but a 'html' file type, combined with a filename containing a string of at least 20 alphanumeric characters, plus or minus, equal signs, which is characteristic of base64 encoding.
This rule detects suspicious network connections or process executions initiated by processes whose command line contains specific 'ClawAgents' keywords and, in the case of process execution, also contains the keyword 'clone'. It specifically excludes known browser processes from the network connection detection to reduce false positives. The 'ClawAgents' appear to be related to a specific threat or toolset, and the 'clone' keyword suggests activities like cloning repositories or creating copies, which could be indicative of malicious operations.
This rule detects suspicious activity involving the WebDAV client, specifically looking for scenarios where WebDAV connections to public IPs are initiated from a process that has recently modified the RunMRU registry key to include WebDAV parameters and executables like 'cmd' or 'net use', and has also accessed clipboard data. This combination of behaviors suggests potential credential theft or lateral movement attempts using WebDAV.
Page 11 of 55