Syed Usfar Wasim
@nCD24DeutschlandCompletionist
0 followers15 downloads736 copies14 likes1,338 views
45 detections
Filters
Last updated
All Time
Detection languages
45
Categories
4
2
2
2
2
Platforms
18
8
3
2
2
Products / Services
4
3
3
1
1
MITRE Techniques
8
7
7
6
6
CVEs
3
3
1
1
1
IDS Classtypes
2
1
This detects a suspicious process pattern where "svchost.exe -> svchost.exe -k DHCPServer" running under the Network Service account.
Detects rundll32.exe making outbound network connections to public IP addresses, excluding cases where the parent process is svchost.exe. This indicates the abuse of "rundll32.exe" as a proxy execution binary for defense evasion, payload execution, or suspicious network communication.
Detects suspicious execution of tools or command lines associated with DPAPI domain backup key extraction, including mimikatz, SharpDPAPI, lsadump::backupkeys, and related backupkey commands. This behavior may indicate an attempt to obtain the domain DPAPI backup key from a Domain Controller, enabling decryption of DPAPI-protected secrets across the domain.
This query detects non-browser processes making network connections to .shop or .xyz domains which could possibly pertain to phishing, malware delivery, tracking, ad fraud, or command-and-control.
This query hunts for suspicious cases where Warp Terminal or a Warp-related parent process spawns Unix-like shell interpreters such as sh, bash, zsh, fish, or dash, and executes commands using shell execution patterns like -c, /bin/sh, sh -c, or bash -c. It detects suspicious post-condition behavior consistent with exploitation attempts for CVE-2026-48703 and CVE-2026-48731
https://www.okta.com/en-au/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/
This query detectsvinbound web requests containing a suspicious Content-Security-Policy or Content-Security-Policy-Report-Only request header with signs of nonce attribute breakout and JavaScript/data URI injection
ARTokenC2NetworkTraffic - fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform.
Detects high-frequency failed logon attempts (>= 6) against accounts with administrative naming conventions within a 3-minute window. The rule specifically flags activity targeting multiple distinct destination hosts, which is a strong indicator of lateral movement or account brute-forcing/spraying attempts across an enterprise network.
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
Page 4 of 5