Daniel Koifman
@KoifsecTrusted contributorCompletionist
4 followers237 downloads217 copies5 likes48,125 views
51 detections
Filters
Last updated
All Time
Detection languages
17
16
9
6
3
Categories
20
6
3
3
2
Platforms
34
1
1
Products / Services
16
3
MITRE Techniques
7
5
5
4
4
The rule detects the execution of processes which are unique identifiers for the NetMonitor agent.
The rule detects write access to files named NTUSER.MAN by monitoring Windows Security Event Log event ID 4663.
The rule detects the execution of a command line containing both SyncAppvPublishingServer.vbs and a semicolon (;).
The rule detects the execution of PowerShell where the command line includes invoke-CimMethod. This specifically highlights the programmatic invocation of CIM methods, alerting analysts to potential WMI-based attacks or unauthorized administrative actions being performed via script.
The rule detects the execution of w32tm.exe with the stripchart command-line argument.
This rule alerts on outbound network activity initiated by gup.exe where the destination URL is not associated with expected Notepad++ update endpoints.
SPL Query from file: Defender Exclusion Added via WMIC
The rule detects the loading of log.dll into a process where the process executable is not located in the standard Bitdefender installation directories.
The rule detects the execution of dllhost.exe where the command line includes the Class ID (CLSID) for the CMSTPLUA or ICMLuaUtil interfaces.
The rule detects the execution of bcdedit.exe with command-line arguments containing both "testsigning" and "on".
Page 5 of 6