Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
This rule identifies network activity that could be indicative of command and control (C2) communication or reconnaissance. It specifically looks for two patterns: DNS queries to 'api.ipify.org', which is a service used to determine the public IP address, or outbound network connections on port 7712 to external IP addresses (excluding common private IP ranges). Both of these activities, especially when combined, can be associated with malicious software like the MonsterV2 C2 framework, which might use such methods for initial reconnaissance or C2 communication.
Detects the execution of SyncAppvPublishingServer.vbs with a command line containing a semicolon, which is indicative of the ClearFake malware campaign's ClickFix technique. This technique abuses SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands, often delivered via social engineering involving malicious copy-paste actions.
This rule detects attempts to establish persistence by modifying the 'RunMRU' registry key to execute malicious commands. It specifically looks for the presence of common scripting and download utilities (powershell, pwsh, mshta, certutil, bitsadmin, curl, wget) combined with indicators of remote execution or code download (http, iex, Invoke-Expression, DownloadString, iwr, Invoke-WebRequest) within the registry data.
This rule detects attempts to use the Windows registry key 'Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths' to execute potentially malicious commands. It specifically looks for the presence of 'powershell', 'mshta', 'certutil', 'curl', 'bitsadmin', or 'wget' within the registry data associated with this key. This technique can be used for persistence or execution of malicious payloads.
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
This rule detects attempts to delete S3 bucket logging configurations originating from IP addresses not associated with AWS infrastructure. This could indicate an attacker attempting to cover their tracks by disabling logging for an S3 bucket after gaining unauthorized access.
High AWS S3 Object Deletion Count
Cortex XDR
Detects when a single IP address or identity performs a high number of S3 object or bucket deletions within a short timeframe. This could indicate an attacker attempting to destroy data, evade detection, or disrupt services.
VM Escape VMware VMCI Device Disabling
Cortex XDR
This rule detects attempts to disable VMware VMCI (Virtual Machine Communication Interface) devices using 'devcon.exe'. This activity can be indicative of a VM escape attempt, as disabling VMCI might be a step to bypass security mechanisms or facilitate further exploitation within a virtualized environment. The rule specifically looks for 'devcon.exe' executing with 'disable' in the command line, targeting either 'PCI\VEN_15AD&DEV_0740' (VMCI device) or 'ROOT\VMWVMCIHOSTDEV' (VMCI host device).
Detects the presence of specific Chrome, Edge, or Firefox browser extension IDs associated with the DarkSpectre Zoom Stealer malware. This rule aims to identify compromised systems exhibiting the installation artifacts of the malicious browser extensions.
Detects indicators of React2shell exploitation originating from 'node' or 'next' processes on web-facing or internet-facing assets. This rule identifies suspicious network connections to common web ports (3000, 8080, 443, 80) or process executions containing command-line arguments indicative of prototype pollution exploitation (e.g., '__proto__', 'constructor:constructor', 'process.mainModule.require', 'execSync', 'vm.runInThisContext', 'fs.readFileSync') or common post-exploitation commands ('whoami', '/etc/passwd', 'id', 'env', 'hostname').
Page 23 of 25