Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects the issuance of certificates using templates associated with the Certificate Request Agent. This is a critical component of the ESC3 attack vector, where an adversary first acquires an Enrollment Agent certificate and subsequently uses it to enroll for certificates on behalf of other privileged users or principals.
Detects the use of PowerShell (Invoke-WebRequest or Invoke-RestMethod) to download files to the AppData directory, followed by the execution of a file using a 'token-raw' argument. This pattern is often associated with malicious payload delivery and execution.
Detects the execution of known Remote Monitoring and Management (RMM) and remote access tools. The rule specifically flags these tools when they are executed from high-risk directories such as AppData, Temp, Downloads, or ProgramData, which is a common indicator of unauthorized installation or persistence efforts by an adversary.
Detects execution of pythonw.exe (windowless Python) from user-writable directories (e.g., AppData, Temp, Downloads) when launched by common parent processes typically associated with initial access or execution, indicative of the SynkLoader C2 malware.
Detects the execution of VBS scripts (wscript.exe or cscript.exe) that interact with the Windows Startup folder to create shortcuts. This behavior is associated with persistence mechanisms where malicious scripts create masqueraded shortcuts (e.g., SecurityHealth, OneDriveUpdate) in the user's Startup folder, often using hidden attributes to evade detection.
Detects persistence and configuration activity associated with the CornFlake RAT, including the creation of malicious Windows services (e.g., 'svchost32', 'Cloud Sync Service'), registry run key modifications, and the presence of specific file artifacts like 'sync.dat' and malicious executables within AppData directories.
Microsoft Graph API Calendar C2 Activity
Cortex XDR
Detects anomalous Microsoft Graph API activity targeting calendar events and attachments, indicative of the HOLLOWGRAPH C2 protocol. The rule identifies application identity accounts using non-browser user agents to perform suspicious operations (e.g., creating events with future-dated timestamps, specific subject tag formats like 'Boss{..}ID{..}' or 'Event ID:', and file attachments named 'File{n}.txt'). This pattern suggests the use of a compromised M365 mailbox as a two-way dead-drop for C2 and data exfiltration.
Detects the enablement of the Remote Desktop Protocol (RDP) by modifying registry keys or service configurations, specifically when triggered by identified remote access tools or common script interpreters (cmd, powershell, etc.) executing from non-standard user-writable paths such as Temp or AppData. This behavior is indicative of lateral movement preparation.
Detects the creation of Windows Registry Run keys that masquerade as legitimate Realtek or WinAudio services. These keys point to executables located in user-writable paths such as AppData, Roaming, or Temp, a technique commonly associated with persistence mechanisms for malware like the Chaos ransomware.
High-Entropy Subdomain AAAA Queries
Cortex XDR
Detects DNS queries using IPv6 (AAAA) records that contain high-entropy, long subdomain strings, which are indicative of DNS tunneling techniques. The rule specifically targets patterns similar to the HOLLOWGRAPH malware, which encodes data within subdomain labels to facilitate C2 communication.
Page 8 of 25