Kenji Choy
@kchoyCompletionist
0 followers125 downloads341 copies10 likes27,697 views
25 detections
Filters
Last updated
All Time
Detection languages
17
8
Categories
4
3
3
3
2
Platforms
11
3
Products / Services
6
3
1
1
1
MITRE Techniques
6
6
4
4
4
Detects a DLL sideloading technique used by APT41 where the legitimate VipreAV executable 'vetysafe.exe' is used to load a malicious 'sbamres.dll'. This is a known method for deploying the Deed RAT.
This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events, which is a high-fidelity source for this activity in Microsoft Defender for Endpoint.
This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events from data mapped to the Elastic Common Schema (ECS).
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
Page 3 of 3