Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower44 downloads1,000 copies20 likes3,160 views
122 detections
Filters
Last updated
All Time
Detection languages
74
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
23
17
Products / Services
21
20
17
11
8
MITRE Techniques
28
23
23
12
8
IDS Classtypes
1
Detects modifications, registrations, or deletions of security information for a user account, or general management updates within the user directory, which may indicate account tampering or unauthorized privilege persistence.
Detects when a non-system application on an Android device is granted Accessibility Service permissions or Notification Listener access. Malicious actors frequently abuse these permissions to perform overlay attacks, keylogging, or intercepting sensitive information such as 2FA codes.
Detects the execution of various command-line tools (sc, net, powershell, wmic, taskkill, systemctl, launchctl) used to stop or disable system services. This behavior is often associated with adversaries attempting to stop security services, backup agents, or other critical infrastructure for impact, defense evasion, or prior to data destruction.
Suspicious Discovery Command Execution
Cortex XDR
Detects the execution of common command-line utilities frequently used by adversaries for system, network, and account discovery after gaining initial access to a host.
Detects the parsing of Mach-O headers for files with specific, potentially anomalous extensions. This is often used to identify masqueraded executables, unsigned binaries, or files with suspicious RPath configurations that may indicate malicious activity.
Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.
This rule detects the execution of QuickAssist.exe or RemSupp.exe on a host where Microsoft Teams has also been executed within the last day. This pattern may indicate the use of built-in remote support tools in conjunction with communication platforms, potentially for unauthorized remote access or suspicious remote assistance activities.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
Detects the creation and subsequent execution of AppleScript files (.scpt) using the 'osascript' command-line utility on macOS. This pattern is commonly used to automate tasks, but can be leveraged by attackers for malicious payload execution or system interaction.
Cortex XDR Process Lineage Observation
Cortex XDR
This rule monitors and retrieves process lineage information, including child process execution, parent process context, and grandparent process hierarchy for a specific host. It extracts process execution details such as image names and command lines to provide visibility into process trees for forensic investigation and behavior analysis.
Page 10 of 13