Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower44 downloads1,000 copies20 likes3,160 views
122 detections
Filters
Last updated
All Time
Detection languages
74
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
23
17
Products / Services
21
20
17
11
8
MITRE Techniques
28
23
23
12
8
IDS Classtypes
1
Detects user accounts that have been disabled for an extended period (greater than 100 days), which could potentially be abused or overlooked.
Detects DNS requests to major generative AI and Large Language Model API endpoints (such as OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, and others) initiated by processes other than standard web browsers (e.g., chrome, msedge, firefox, safari). This behavior may indicate unauthorized data exfiltration, shadow AI usage, or automated tooling/scripts interacting with LLM APIs.
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects potential Multi-Factor Authentication (MFA) fatigue or push bombing attacks against Azure Active Directory (Entra ID) accounts by identifying a high volume of MFA failures followed by suspicious or fraudulent report actions, or successful authentications shortly after repeated failures.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
This rule detects suspicious driver loading from user-writable paths, kernel driver service creation, disabling of driver signing, loading of Linux kernel modules, and the usage of LD_PRELOAD for rootkit functionality.
Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.
Detects when a web browser (such as Chrome, Edge, Firefox, Internet Explorer, Brave, or Opera) spawns common command interpreters, scripting engines, or Living off the Land Binaries (LOLBins) like cmd, powershell, mshta, rundll32, or certutil. This behavior is often indicative of a drive-by compromise or browser exploitation attempt.
Page 1 of 13