Daniel Koifman
@KoifsecTrusted contributorCompletionist
4 followers237 downloads217 copies5 likes48,125 views
51 detections
Filters
Last updated
All Time
Detection languages
17
16
9
6
3
Categories
20
6
3
3
2
Platforms
34
1
1
Products / Services
16
3
MITRE Techniques
7
5
5
4
4
Credential spraying against multiple service principals across identity platforms simultaneously. The ASIM imAuthentication parser normalizes Entra, Okta, AWS, and on-prem AD into a single schema — the detection fires regardless of which platform the attacker targets.
Service principal data access volume exceeding 3 standard deviations from its 14-day baseline. A service principal that normally accesses 50 mailbox items per hour suddenly accessing 5,000 is a strong exfiltration signal — even though the access itself is “authorized” by its permissions.
InnoSetup User Agent
YARA-L
This rule detects network traffic where the User-Agent string includes "innodownloadplugin".
The rule detects an object access event (Event ID 4663) initiated by Windows Defender, where the target file is located outside the legitimate Microsoft Defender directories (C:\Windows\System32\ or C:\ProgramData\Microsoft\), indicating potential usage of a tool like "EDRStartupHinder".
The rule detects the installation of the Gorelo RMM service by monitoring Windows System events (Event ID 7045) or Security events (Event ID 4697), which record the creation of new services. It specifically looks for service names or binary paths containing the string "gorelo", flagging the moment the agent is first established on the system.
The rule detects the execution of dllhost.exe where the command line includes the Class ID (CLSID) for the CMSTPLUA or ICMLuaUtil interfaces.
The rule detects access attempts (Event ID 4663) to theAppIDSvc service object. This captures the moment a process interacts with the service's configuration, such as changing its startup type from "Manual" to "Auto" or forcing it to start.
The rule detects handle requests and access attempts (Event ID 4663) to the SrpV2\Exe registry key.
The rule detects the execution of the devcon.exe process with a command-line argument containing the word "disable". This is a strong indicator that an attempt is being made to disable one or more hardware devices on the system, which is highly suspicious outside of legitimate administrative or deployment activities.
The rule detects object access events (Event ID 4663) targeting files within the \Windows\System32\AppLocker directory. This identifies unauthorized attempts to read, write, or delete the system's application control policy cache, a behavior indicative of an attempt to tamper with endpoint security defenses.
Page 4 of 6