Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,280 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
Detects the creation or update of mailbox inbox rules within 30 minutes of a successful sign-in event using the OAuth device code flow. This sequence is often observed in Business Email Compromise (BEC) attacks where an attacker uses a stolen or phished device code to access a mailbox and subsequently establishes persistence via malicious mail forwarding or deletion rules to hide their tracks.
Detects changes to the Discretionary Access Control List (DACL) of files within the C:\Config.Msi directory by processes other than msiexec.exe or TrustedInstaller.exe. This directory is used by the Windows Installer and unauthorized modifications to its contents or permissions may indicate an attempt to tamper with installation processes or escalate privileges.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
The analytic detects a PowerShell script that enumerates camera devices on the targeted host. This detection leverages PowerShell Script Block Logging, specifically looking for commands querying Win32_PnPEntity for camera-related information. This activity is significant as it is commonly observed in DCRat malware, which collects camera data to send to its command-and-control server. If confirmed malicious, this behavior could indicate an attempt to gather sensitive visual information from the host, potentially leading to privacy breaches or further exploitation.
Detects the modification of the 'ServiceDLL' Registry value for a Windows service to a path that resides outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. This behavior is often associated with service hijacking or persistence techniques where an adversary points a service to a malicious DLL for execution.
This rule detects the use of GSocket and GS-Netcat utilities, which are often used for creating reverse shells and persistent network tunnels. It monitors for either direct network connections associated with these tools or command-line activity indicating these tools are being configured for persistence using cron jobs, systemd services, or @reboot triggers.
Detects the use of the klist.exe utility with suspicious subcommands ('sessions', '-li', 'get', 'purge') to inspect, retrieve, or clear cached Kerberos tickets, which is indicative of credential discovery or post-exploitation activity.
Detects administrative actions that disable or modify Amazon GuardDuty, which could be an attempt to blind security monitoring or evade detection of malicious activity. This includes disabling a detector, deleting publishing destinations, or modifying threat intel and IP sets.
Detects the execution, network activity, or installation of GSocket (gsocket/gs-netcat) tools used for creating remote access tunnels. The rule also identifies instances where the legitimate 'uptime' binary is masqueraded to execute GSocket commands or establish unauthorized network connections.
This rule detects the installation or modification of kernel-mode drivers on Windows systems. It identifies potential driver installation activities using 'sc.exe' to create a service with a kernel-type driver image, or by monitoring Registry 'ImagePath' updates for services that point to '.sys' files, a common method for rootkit or malicious driver persistence.
Page 5 of 7