ᴅᴜᴛᴄʜʙᴏʏ 😎
@dutchboyTrusted contributorCompletionist
1 follower58 downloads627 copies19 likes30,831 views
35 detections
Filters
Last updated
All Time
Detection languages
35
Categories
9
9
7
5
5
Platforms
23
3
3
1
1
Products / Services
12
3
2
2
2
MITRE Techniques
16
15
15
13
12
CVEs
2
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects potential command-and-control (C2) activity associated with Lazarus Group malware, such as Cryptoistic. This rule identifies outbound TCP connections that do not appear to be using a standard application-layer protocol like HTTP/S, which is a characteristic of some custom backdoors used by the group. The rule filters for successful outbound TCP connections with an empty RemoteUrl, excluding private IP ranges and a allowlist of common processes. It further prioritizes processes running from suspicious user-writable locations and requires more than two connection attempts to reduce noise.
Detects command-line activity aimed at discovering password manager processes or database files. This technique is often used by attackers during the reconnaissance phase to find stored credentials.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
Detects potential exploitation of the critical SharePoint “ToolShell” zero‑day vulnerability (CVE‑2025‑53770), in which attackers leverage unsafe deserialization of untrusted data in SharePoint’s ToolPane.aspx endpoint to achieve unauthenticated remote code execution via IIS worker process behavior.
Page 4 of 4