Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower44 downloads1,000 copies20 likes3,160 views
122 detections
Filters
Last updated
All Time
Detection languages
74
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
23
17
Products / Services
21
20
17
11
8
MITRE Techniques
28
23
23
12
8
IDS Classtypes
1
This rule identifies potential DNS tunneling or beaconing activity by detecting an unusually high volume of DNS queries (exceeding 50 requests) made to a specific domain name within a given timeframe. Such patterns are often associated with C2 communication or data exfiltration via the DNS protocol.
Detects the execution of common command-line utilities and tools used to enumerate virtual machines, hypervisors, and cloud instance information. Adversaries may perform this reconnaissance to identify virtualization environments, sandbox targets, or cloud infrastructure configurations.
This rule correlates Microsoft Entra ID (formerly Azure AD) risk events identified as 'passwordSpray' with subsequent sign-in logs from the same source IP address within a 60-minute window. This helps identify successful or suspicious authentication activity originating from an IP address previously flagged for password spraying attempts against a specific user account.
Detects the creation of new executable files within a directory path containing 'Download'. This behavior is often associated with the delivery of malicious payloads via browser downloads or other file transfer mechanisms, followed by potential user execution.
Detects instances where Microsoft Outlook (OUTLOOK.EXE) initiates common living-off-the-land (LotL) binaries that are often abused by malicious attachments or macros to execute secondary commands, such as PowerShell, command prompt, or script host engines.
This rule detects DNS requests to common cloud-based infrastructure providers often used by adversaries for Command and Control (C2) operations, including AWS API Gateway, Azure App Service, Google Cloud Functions, and Cloudflare Workers. These domains are frequently leveraged to host redirectors, beaconing infrastructure, or malicious payloads.
Detects instances where a user account performs a device configuration change (such as updating compliance policies) followed by a potentially destructive operation (Wipe, Retire, or Delete) on the same device or entity within a 6-hour window. This behavior often suggests unauthorized administrative activity or a malicious insider attempting to disable security controls before removing access or destroying data.
This rule detects when a .zip archive file is created on a host. The creation of archive files can be a precursor to data exfiltration or a method for adversaries to bundle malicious tools for movement.
Detects the execution of known screen capture and sniping tools (such as SnippingTool, Greenshot, ShareX, OBS, etc.) when initiated from potentially suspicious user-controlled directories like AppData, Temp, or Downloads. This behavior may indicate an attempt to capture sensitive desktop information or credentials.
This rule retrieves security anomaly events generated by Microsoft's identity protection or behavioral analysis systems for a specific user account over a defined time range. It leverages the 'Anomalies' table within Microsoft Sentinel to surface identity-related insights, activity patterns, and flagged risks.
Page 7 of 13