Daniel Koifman
@KoifsecTrusted contributorCompletionist
4 followers237 downloads217 copies5 likes48,125 views
51 detections
Filters
Last updated
All Time
Detection languages
17
16
9
6
3
Categories
20
6
3
3
2
Platforms
34
1
1
Products / Services
16
3
MITRE Techniques
7
5
5
4
4
This rule detects the execution of processes related to 'Netbird', a peer-to-peer VPN solution that can also be used for remote access and management. It specifically looks for 'netbird' in the image file name, original file name, or parent base file name of a process on Windows platforms. Detection of this activity could indicate the legitimate use of Netbird for remote access or, in a malicious context, the deployment of a remote monitoring and management (RMM) tool by an adversary.
This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.
This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.
This rule detects instances where 'dllhost.exe' is spawned by an unusual parent process. Typically, 'dllhost.exe' is spawned by 'svchost.exe' or 'services.exe'. The rule specifically looks for 'dllhost.exe' processes whose parent is neither 'svchost.exe' nor 'services.exe', indicating a potentially malicious or unexpected execution chain.
This rule detects the execution of 'lockapphost.exe' when its parent process is not 'svchost.exe'. 'lockapphost.exe' is a legitimate Windows process responsible for displaying the lock screen and login UI. If it is spawned by an unusual parent process, it could indicate an attempt to bypass the lock screen or manipulate user interface components for malicious purposes, potentially related to persistence or defense evasion.
This rule detects the execution of IOBitUnlocker.exe with the '/delete' command-line argument. IOBitUnlocker is a legitimate tool that can be used to unlock and delete files that are otherwise in use or locked by the operating system. Adversaries may weaponize such legitimate tools to delete files, potentially for data destruction, indicator removal, or to hinder forensic analysis.
New User Agent Per User
YARA-L
Detects when a user begins using a previously unseen HTTP user agent string. Uses 30-day metrics to baseline each user's known user agents. Fires when a new user agent appears for a user who has been active for at least 2 days, indicating possible tooling changes, unauthorized software, or adversary-introduced utilities.
The rule detects HTTP CONNECT requests where the destination port matches a set of suspicious non-standard ports (22, 1080, 1081, 3389, 3128, 8080, 8888, 53, 5900, 4443, 2222) that are commonly associated with tunneling protocols such as SSH, RDP, SOCKS, VNC, and DNS.
This rule alerts when A Kerberos authentication ticket (TGT) was requested or generated using encryption type 0x17 (RC4-HMAC).
Potential DGA Detection
YARA-L
The rule detects hosts that communicate with multiple distinct domains within a short timeframe where each domain contains a subdomain portion of at least 8 alphanumeric characters, matching characteristic DGA patterns, and also includes a Shannon entropy filter.
Page 2 of 6