Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,280 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
This rule detects registry value updates within the 'Microsoft\Windows\CurrentVersion\Installer\TempPackages' hive by processes other than standard Windows Installer-related binaries (e.g., msiexec.exe, TrustedInstaller.exe, or TiWorker.exe). Modification of this registry location by unauthorized processes may indicate an attempt to interfere with package installation, potential persistence, or defense evasion activities.
This rule detects the creation of a new .sys driver file outside of standard Windows system directories (System32/drivers, DriverStore, SysWOW64/drivers) followed by the registration or modification of a service in the Windows Registry (CurrentControlSet/Services) within 15 minutes. This pattern is indicative of potential unauthorized driver installation or a Bring Your Own Vulnerable Driver (BYOVD) attack.
Detects the deployment of container images in AWS ECS or EC2 via RunInstances or RegisterTaskDefinition from registries other than Amazon Elastic Container Registry (ECR) or public ECR. This rule identifies potentially unauthorized or untrusted container sources, which could indicate an adversary attempting to deploy malicious images for persistence or exploitation.
Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.
Detects the execution of cmdkey.exe with the /list flag, which is used to enumerate credentials stored in the Windows Credential Manager. This technique is often used by adversaries for post-compromise reconnaissance to identify stored credentials for lateral movement.
Detects suspicious patterns of LLM API usage by monitoring outbound traffic to major LLM providers (OpenAI, Anthropic, Google, DeepSeek, Mistral, Cohere). The rule identifies potential API key theft ('LLMjacking') by flagging high request volumes from single keys, usage of the same key across multiple distinct source IP addresses, and direct outbound traffic bypassing established proxy/gateway configurations.
Detects modifications to AWS GuardDuty configurations, including disabling the detector, deleting publishing destinations, or altering threat intelligence sets and trusted IP lists. These actions could indicate an attempt to blind security monitoring or evade detection.
Detects high severity (>= 9.0) AWS GuardDuty findings indicating that an EC2 instance or ECS cluster has been compromised, typically suggesting active exploitation or control by a malicious actor.
Detects instances where files located in root or non-standard paths are opened by processes that are not core Windows system processes or Microsoft security products, which may indicate suspicious activity such as manual file interaction or discovery.
Detects the creation or modification of Windows kernel-mode services using the sc.exe utility when the process is not initiated by the legitimate service control manager (services.exe). This behavior is often associated with the loading of malicious drivers or rootkits, which may attempt to bypass standard service management processes to maintain persistence or elevate privileges.
Page 6 of 7