Thomas Carr
@TomcatUKCompletionist
12 followers69 downloads266 copies53 likes2,495 views
18 detections
Filters
Last updated
All Time
Detection languages
18
Categories
6
5
5
3
2
Platforms
14
2
1
Products / Services
9
2
2
1
1
MITRE Techniques
7
4
4
3
2
CVEs
1
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This rule detects suspicious file access patterns to Chromium-based browser extension data folders. Specifically, it looks for any process other than the browser itself (msedge.exe, chrome.exe, wavebrowser.exe, vivaldi.exe, brave.exe, brchrome.exe) reading or accessing files within the 'AppData\Local\User Data\Default\Extensions' directory. This activity could indicate an attempt by malware or an unauthorised process to inspect, modify, or exfiltrate data related to browser extensions, potentially for credential theft, session hijacking, or to inject malicious code into extensions.
This rule detects suspicious execution of MSBuild.exe from non-standard user-writable temporary or roaming directories. Adversaries often abuse MSBuild.exe, a legitimate Microsoft utility, to proxy execution of malicious code, bypassing application control defenses. The rule specifically looks for MSBuild.exe running from common temporary or user-controlled paths like AppData\Local\Temp, AppData\Roaming, C:\Temp, or C:\Users\Public, which is indicative of potential malicious activity such as process injection or execution of infostealers like Lumma Stealer.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
KQL Query from file: Suspicious FileFix activity
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
This rule detects activity from a list of specified malicious IP addresses across network connection events and sign-in attempts. It correlates `DeviceNetworkEvents` (network connections from devices) and `SigninLogs` (user authentication attempts) to identify instances where these IPs are involved. The rule is designed for hunting, looking back 30 days for any activity originating from the defined IP addresses.
This hunt identifies activity related to known malicious domains or URLs across network, email, and messaging telemetry over the past 30 days. It searches for domain-based IOCs within device network events, emails, and Microsoft Teams messages to highlight potential indicators of compromise (IOCs). It tracks delivery actions and recipients for further investigation.
KQL Query from file: PowerShell-Based Event Log Clearing
Page 2 of 2