Syed Usfar Wasim
@nCD24DeutschlandCompletionist
0 followers15 downloads736 copies14 likes1,338 views
45 detections
Filters
Last updated
All Time
Detection languages
45
Categories
4
2
2
2
2
Platforms
18
8
3
2
2
Products / Services
4
3
3
1
1
MITRE Techniques
8
7
7
6
6
CVEs
3
3
1
1
1
IDS Classtypes
2
1
Detects Microsoft Defender XDR UrlClickEvents where a clicked URL or extracted clicked domain matches known Coinbase Cartel-related URL, onion, messaging, or infrastructure indicators.
Detects file, process, or image-load events in Microsoft Defender XDR where the file hash or initiating-process hash matches known Coinbase Cartel-related hash indicators.
This query detects PowerShell-based AES encryption activity followed by mass file rename/encryption indicators and ransom note creation within a correlated pre-defined timestamp.
This query is trying to identify cases where a newly created machine account may correspond to a device that quickly begins exposing domain-controller-like services, especially LDAP and SMB.
This detects a possible VPN brute-force or password-spray followed by successful authentication, where the same user has 5 failed SSL VPN login attempts followed by a successful tunnel-up event within 2 minutes.
Detects endpoint file artifacts associated with known malicious browser extension IDs in browser extension storage paths, indicating possible installation or presence of malicious browser extensions.
Detects high-confidence BoryptGrab-lineage infostealer activity involving fake GitHub delivery indicators, known C2 infrastructure, suspicious gup.exe execution, libcurl.dll side-loading from user-writable paths, and known malicious file hashes.
Detects which privileged users have signed in recently, how often, from how many IPs/apps, what authentication methods they used, and whether any password-only sign-ins occurred?
This KQL detects potential Microsoft Defender tampering via PowerShell, including attempts to disable real-time or behavior monitoring and add Defender exclusions. It enriches results with tamper type, suspicious PowerShell flags, and confidence level to help prioritize medium/high-confidence activity.
This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.
Page 3 of 5