Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower44 downloads1,000 copies20 likes3,160 views
122 detections
Filters
Last updated
All Time
Detection languages
74
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
23
17
Products / Services
21
20
17
11
8
MITRE Techniques
28
23
23
12
8
IDS Classtypes
1
Detects the execution of an 'update.exe' process initiated by 'svchost.exe' where the update executable resides in non-standard, user-writable directories (AppData, Temp, Users Public, or Downloads). This behavior is highly suspicious as svchost.exe should typically only execute binaries from system directories, and the target file is running in a location common for malware staging.
Detects the execution of nslookup.exe invoked by common shell programs (cmd.exe, powershell.exe, etc.) with command-line arguments indicative of network scanning or discovery activities, such as targeting specific IP addresses or requesting specific DNS record types.
Detects the execution of cmd.exe, powershell.exe, or pwsh.exe launched directly from Windows Explorer (explorer.exe) where the command line contains obfuscated arguments, long encoded strings, or specific indicators associated with common click-based execution attacks.
Detects instances where a web browser process creates a new executable file (.exe) in the 'Downloads' folder without a corresponding network connection event recorded by the browser to an executable URL. This pattern is indicative of potential in-browser assembly of a malicious file or an executable being dropped via non-standard browser download pathways, such as through local file system manipulation or hidden secondary processes.
Suspicious Script and Utility Execution
Cortex XDR
This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).
Detects potential password spraying or brute force activity against Entra ID by monitoring for a high number of failed authentication attempts from a single IP address targeting multiple unique user accounts within a 15-minute window.
This rule monitors process command line arguments for strings containing 'maliciousdomain.com'. This pattern is indicative of a process interacting with a known malicious domain, commonly associated with phishing campaigns or initial access attempts where malicious links or payloads are invoked via command-line tools.
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
Detects execution of Lua/LuaJIT binaries, specifically luau.exe or lua(jit).exe, with command-line arguments referencing ico64.txt, or execution via application.cmd. This behavior is often associated with malware loaders attempting to execute secondary scripts or payloads.
This rule detects the execution of the Screaming Frog SEO Spider application followed by outgoing network traffic to web ports (80/443). Screaming Frog is a legitimate web crawler often repurposed by adversaries for internal or external network reconnaissance and site scraping.
Page 11 of 13