Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
SleepyDuck Malware Etherhiding
Cortex XDR
This rule detects network connections to specific RPC addresses and a contract address associated with the SleepyDuck malware's Etherhiding technique. It filters for DNS queries containing known RPC domains and HTTP/network activity containing a specific Ethereum contract address. This indicates potential communication with the malware's command and control infrastructure for persistence.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
This rule detects when known code scanning tools like Trufflehog, Gitleaks, or Gittyleaks attempt to read the AWS credentials file. This activity could indicate an adversary or an internal security tool searching for sensitive AWS access keys and tokens.
Detects malware masquerading as the 'init' process to evade detection. This rule specifically looks for processes named 'init' that do not have an instance ID of '1' and are not located in the standard '/sbin/init' or '/usr/lib/systemd/systemd' paths. It also flags processes in suspicious temporary directories.
Detects COLDDRIVER malware loading specific malicious DLLs (machinerie.dll, checkme.dll, iamnotarobot.dll) via rundll32.exe, or the loading of specific malicious DLLs identified by their SHA256 hashes.
PHALT BLYX Startup URL Persistence
Cortex XDR
Detects the creation of .url files in the Windows Startup folder, which can be used for persistence. Specifically identifies a known IOC for PHALT BLYX malware ('DeleteApp.url') and flags other suspicious .url file creations in the Startup folder. This rule filters out common browser processes that might legitimately create .url files.
Azure Device Code OAuth Consent
Cortex XDR
This rule detects suspicious activity related to Microsoft 365 Device Code OAuth consent flows. It specifically looks for device code authentications that are single-factor or lack MFA, and then groups these by IP address and client application. The rule identifies suspicious patterns such as a high number of logins, unique users, or unique applications from a single IP address, or rapid login attempts within a short timeframe, which could indicate enumeration or phishing attempts.
This rule detects Amazon S3 PutObject events where server-side encryption is performed using SSE-C (Server-Side Encryption with Customer-Provided Keys) or where the request uses Signature Version 2 (SigV2). SSE-C relies on the customer to manage encryption keys, which can introduce risks if not handled securely. SigV2 is an older, less secure authentication protocol for AWS requests and its use is generally discouraged in favor of SigV4.
This rule detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value to '1' under a key containing 'WDigest'. The detection specifically looks for this modification being performed by a process whose image name matches a custom batch file pattern (e.g., ending with '!light*.bat'). This activity is associated with Qilin ransomware, which has been observed using this technique for credential access.
Detects modifications to critical registry settings that weaken security controls related to NTLM authentication, Restricted Admin mode, and RDP security. The rule specifically looks for disabling NTLM traffic restrictions (RestrictSendingNTLMTraffic set to 0), disabling Restricted Admin mode (DisableRestrictedAdmin set to 0), or weakening RDP security by setting the SecurityLayer to '1'. An alert is generated if two or more such modifications occur within a 7-day timeframe.
Page 24 of 25