Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,280 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
This rule detects the execution of Java JAR files from suspicious or unconventional directories (such as Temp, AppData, Downloads, or Public folders). It filters out known build tools and CI/CD agents to focus on potentially malicious or unauthorized execution of JAR files that might indicate payload staging or execution in high-risk locations.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects instances where the msiexec.exe process, running under the local system account (S-1-5-18), deletes files located within the 'C:\Config\.Msi' directory. This behavior is often associated with the misuse of the Windows Installer service or exploitation techniques intended to leverage system-level file operations for privilege escalation or persistence.
Detects execution of gsocket-related tools (gs-netcat, gsocket, gs-sftp) or command-line patterns typically used for remote shell access or socket redirection, such as using -e with a shell, -l/-p for listening, or redirecting I/O from common temporary directories.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
KQL Query from file: The Hunt for QR Phisher
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.
Page 4 of 7