Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,204 copies871 likes151,523 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
This rule detects potential phishing activity by identifying inbound emails from specific sender addresses that were not blocked by Microsoft Defender for Office (MDO), followed by network connections to a known malicious infrastructure associated with 'Tycoon2FA'. The rule first looks for unblocked emails from 'donotreply@docmagic.com' and 'noreply@frigoarrobba.com.br'. If such emails are found, it then checks for network connections to 'listener.facraivo.sa.com' within a 7-day window, indicating a potential compromise or user interaction with the phishing attempt.
https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers
This rule detects outbound network connections to domains associated with the Tykit malware family or domains matching a specific regular expression pattern often used for credential harvesting (e.g., 'loginmicr.s*.cc'). It leverages an external intelligence feed for known Tykit domains and a regex for common phishing/credential theft patterns.
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection on port 7712 to a non-private IP address. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
This rule detects the creation of files with specific malicious extension IDs on devices. These extensions are typically associated with browser-based malware or unwanted programs that modify browser behavior, steal data, or perform other malicious activities. The rule specifically looks for `FileCreated` events where the `FileName` matches any of the predefined malicious extension IDs.
https://gist.github.com/whichbuffer/4dab8a4d4ce4fea0dbfe73b7e3c3f6a7
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
KQL Query
KQL Query
KQL Query from file: Detecting Threat Actor Storm-2657
Page 14 of 55