Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects anomalous access to AWS Bedrock Knowledge Bases, identifying a pattern of initial reconnaissance (enumerating bases and data sources) followed by high-volume querying (Retrieve/RetrieveAndGenerate). This sequence is indicative of an attacker attempting to map out backend storage configurations and subsequently exfiltrate indexed document content.
Detects unauthorized modification or deletion of AWS Bedrock guardrails. Adversaries may delete or degrade these guardrails (lowering sensitivity to 'NONE' or 'LOW') to bypass content filters, PII redaction, and safety controls, enabling toxic output generation or data exfiltration via LLM applications.
Detects the use of long-lived AWS IAM access keys (AKIA) to perform critical AWS Bedrock operations such as enabling foundation model access (PutUseCaseForModelAccess, CreateFoundationModelAgreement). Such sensitive configurations are typically expected to be performed via the AWS Console using federated credentials; the use of long-lived keys for these specific actions is a strong indicator of potential compromise and unauthorized resource enablement.
Detects the abuse of the DFS Namespace Management (DFSNM) interface by monitoring calls to NetrDfsAddStdRoot (opnum 12) and NetrDfsRemoveStdRoot (opnum 13). An adversary can trigger these functions to coerce a Windows host to authenticate to an attacker-controlled remote host using NTLM, facilitating NTLM relay attacks.
Remote Scheduled Task Creation via RPC
Cortex XDR
This rule detects the creation of scheduled tasks on a remote host via the Task Scheduler RPC interface (opnum 1, RegisterTask). This interface is commonly abused by lateral movement tools such as Impacket's atexec, SharpTask, and SynkLoader to execute code or establish persistence on a remote system.
Remote Registry Access via Winreg RPC
Cortex XDR
Detects suspicious remote registry operations performed through the Winreg RPC interface. The rule monitors for interactions with sensitive registry hives (e.g., SAM, SECURITY, SYSTEM) or anomalous levels of remote registry activity originating from remote connections (SMB, TCP, Named Pipes). Such activity is often associated with credential dumping tools like Impacket's secretsdump or unauthorized remote configuration discovery.
PetitPotam NTLM Coercion via EFSRPC
Cortex XDR
This rule detects the use of EfsRpcOpenFileRaw (opnum 0) against the EFSRPC interface. This specific function is abused by the PetitPotam exploit to coerce a Windows machine, typically a domain controller, into authenticating to an attacker-controlled host via NTLM. This forced authentication is a precursor to NTLM relay attacks such as those targeting Active Directory Certificate Services (AD CS).
Detects potentially malicious LDAP queries logged by Windows Server 2025 (Event IDs 3039/3040). The rule monitors for common attacker reconnaissance techniques, including Kerberoasting, AS-REP roasting, delegation abuse, AD CS enumeration, and BloodHound-style data collection patterns.
Remote Service Creation via SVCCTL RPC
Cortex XDR
Detects remote service manipulation, including service creation, starting, and deletion, using the SVCCTL RPC interface. This activity is a common method for lateral movement and remote code execution by tools like PsExec, smbexec, and CrackMapExec.
SAMR User and Domain Enumeration via RPC
Cortex XDR
Detects high-volume usage of SAMR RPC functions (SamrEnumerateUsersInDomain, SamrLookupNamesInDomain, SamrQueryInformationUser) used to enumerate domain users and account attributes. This behavior is indicative of reconnaissance activities performed by tools such as secretsdump, BloodHound, and NetExec.
Page 5 of 25