Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects modifications to AWS EC2 security groups that allow SSH (port 22) or RDP (port 3389) access from any IP address (0.0.0.0/0) to instances. This configuration significantly increases the attack surface and can be an indicator of unauthorized access attempts, misconfigurations, or malicious activity.
AWS EC2 GetPasswordData API Call
Cortex XDR
Detects when the AWS EC2 GetPasswordData API call is made. This API call retrieves the Windows administrator password for an EC2 instance, which could indicate an attempt to gain unauthorized access to an instance.
Detects when an AWS KMS key deletion is scheduled from a source that is not identified as an Infrastructure as Code (IaC) tool (e.g., CloudFormation or Terraform). This could indicate unauthorized attempts to destroy cryptographic keys, potentially leading to data unavailability or integrity issues.
Azure Blob Storage Account Key Access
Cortex XDR
Detects successful access to Azure Blob Storage using storage account keys (key1 or key2). This activity is often indicative of an adversary using compromised credentials to access cloud storage resources.
Azure Blob SAS Access
Cortex XDR
Detects access to Azure Blob Storage using Shared Access Signature (SAS) authentication. This rule specifically looks for successful blob operations where the authentication type is SAS and the identity name matches 'key1' or 'key2', which are often associated with storage account access keys used to generate SAS tokens. Monitoring such access can help identify unauthorized or suspicious use of SAS tokens.
Detects trojanized VPN processes spawning suspicious child processes (like rundll32, regsvr32, mshta, wscript, powershell, cmd) or writing RunOnce persistence in the registry, or loading malicious DLLs (dwmapi.dll, inspector.dll). The detection specifically targets processes signed by "Taiyuan Lihua Near Information Technology", which has been associated with Storm-2561 activity.
Storm-2561 Network IOC Detection
Cortex XDR
Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.
Storm-2561 Malicious File Hash Detection
Cortex XDR
This rule detects the presence of malicious files associated with the Storm-2561 threat actor by matching their SHA-256 hashes. The rule specifically targets files on Windows operating systems and also filters for files signed by "Taiyuan Lihua Near Information Technology Co., Ltd.", which is known to be associated with these malicious activities. The detected files include ZIP archives, MSI installers, DLLs, and fake VPN executables.
Detects when a new federation identity provider (SAML or OpenID Connect) is created or updated in AWS Identity and Access Management (IAM). This could indicate an attempt to establish new trust relationships for federated access.
This rule detects the launch of Amazon EC2 instances with GPU-enabled or very large instance types. Adversaries may launch such instances for resource-intensive tasks like cryptocurrency mining or other compute-heavy operations, which can lead to unexpected cloud costs and resource hijacking.
Page 20 of 25