ᴅᴜᴛᴄʜʙᴏʏ 😎
@dutchboyTrusted contributorCompletionist
1 follower58 downloads627 copies19 likes30,831 views
35 detections
Filters
Last updated
All Time
Detection languages
35
Categories
9
9
7
5
5
Platforms
23
3
3
1
1
Products / Services
12
3
2
2
2
MITRE Techniques
16
15
15
13
12
CVEs
2
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains).
KQL Query
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
Page 2 of 4