Shadows VMB
@Vemorian_MortTrusted contributorCompletionist
1 follower44 downloads1,000 copies20 likes3,160 views
122 detections
Filters
Last updated
All Time
Detection languages
74
35
13
Categories
45
34
14
13
12
Platforms
70
27
26
23
17
Products / Services
21
20
17
11
8
MITRE Techniques
28
23
23
12
8
IDS Classtypes
1
This rule aggregates sign-in log activity for a specific user to identify the volume and distribution of authentication attempts across different IP addresses, applications, and client types within a specified time range. It is primarily used for identifying anomalies in access patterns that might indicate credential abuse or unauthorized access.
Detects instances where the same user performs both a role assignment (potentially for privilege escalation) and executes a Run Command on an Azure Virtual Machine within a one-hour window. This behavior is indicative of an attacker modifying access control and immediately executing arbitrary code on the target resource.
This rule monitors Microsoft Teams communication logs to identify messages containing URLs. By parsing the message content and extracting domains, this rule facilitates the detection of potentially malicious links, phishing attempts, or unauthorized data sharing within the organization's Teams environment.
Detects a high volume of file rename events initiated by a single process on a device within a short time window (5 minutes). This behavior is often indicative of ransomware activity, where files are renamed as part of the encryption or extortion process.
Detects instances where Microsoft Teams logs report a message containing a 'Malicious url'. This suggests a potential phishing attempt via Teams, where a user is being sent a link classified as malicious by security systems.
This rule detects attempts to bypass macOS Gatekeeper security controls by disabling security policies via the 'spctl' command, or by removing file quarantine attributes using the 'xattr' utility. These techniques are commonly used to execute unauthorized or malicious software that would otherwise be blocked by macOS security features.
This rule detects a significant spike in usage for Azure Cognitive Services, specifically for operations like Chat Completions or Image Generation. By comparing the request count per caller to their historical average (hourly), the rule identifies potential abuse, service disruption, or unauthorized resource usage.
This rule detects when an individual user on a single host launches three or more distinct AI or LLM-related tools (such as ChatGPT, Claude, Cursor, Copilot, Ollama, or LMStudio) within the observed timeframe. This may indicate developers or power users utilizing various AI-assisted coding and productivity tools, but could also indicate unauthorized use of generative AI tools for data processing or exfiltration.
This rule monitors outbound email traffic per sender and flags accounts exceeding a specified hourly threshold. A sudden spike in outbound emails from a single user account may indicate a compromised mailbox being used for spam, phishing, or mass data exfiltration.
This rule detects installation, file activity, or registry configuration changes associated with the 'bright-save-feed@tabtools.org' browser extension identifier. Such identifiers are commonly associated with malicious browser add-ons or potentially unwanted programs (PUPs) that may be used for browser session hijacking, unauthorized content injection, or persistent access.
Page 9 of 13