Kenji Choy
@kchoyCompletionist
0 followers125 downloads341 copies10 likes27,697 views
25 detections
Filters
Last updated
All Time
Detection languages
17
8
Categories
4
3
3
3
2
Platforms
11
3
Products / Services
6
3
1
1
1
MITRE Techniques
6
6
4
4
4
This rule detects a successful Remote Desktop Protocol (RDP) login that is immediately preceded by 20 or more failed RDP authentication attempts from the same source IP to the same destination IP within a 15-minute window. This pattern is indicative of a brute force attack that has successfully compromised credentials.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
This rule extracts and normalizes Windows Event Logs from both SecurityEvent and Event tables within a 24-hour window. It serves as a foundational query to gather general Windows event logs, similar to what a 'wineventlog' source would provide, and normalizes key fields for consistent security hunting and analysis. The rule specifically projects fields such as TimeGenerated, Computer, EventLog, EventID, SourceName, Level, and Message from both log sources.
Identifies when Microsoft Defender for Endpoint blocks or quarantines a file, extracting the malicious SHA256 hash. This rule specifically looks for `DeviceEvents` and `DeviceFileEvents` where an action type indicates a block or quarantine, and then extracts additional details like `ThreatName` and `AvAction` to confirm the successful intervention. It also includes an exclusion list for known benign hashes like EICAR.
This rule identifies various indicators of Mimikatz execution, including specific command-line arguments, file names, suspicious access to the LSASS process memory, and the creation or loading of malicious services or DLLs associated with Mimikatz. It aims to detect credential dumping activities and persistence mechanisms often employed by attackers.
Identifies when the ScreenMeet.Support.exe RMM tool is downloaded on a host or initiates network connections. This rule detects file creation events for 'ScreenMeet.Support.exe' and network connections made by processes with 'ScreenMeet.Support.exe' as the initiating process filename.
Purpose:
The query is designed to detect and alert on emails received from typosquatted domains, which are domains that closely mimic legitimate domains by having slight variations, often used in phishing attacks.
The query is designed to detect and alert on emails received from typosquatted domains, which are domains that closely mimic legitimate domains by having slight variations, often used in phishing attacks.
This rule detects the connection of external Plug and Play (PnP) devices, including USB storage, to a system. It identifies events where a USB drive is mounted or a generic PnP device is connected, extracting details such as vendor, product ID, and serial number for investigation.
This query identifies outbound network connections made by the notepad++.exe process. This is useful for hunting for suspicious activity, such as connections to malicious update servers or C2 channels, by baselining normal update and plugin activity.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
Page 2 of 3