Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a high frequency of UAC consent prompts (consent.exe) originating from a single parent process, followed by the launch of a common Living Off The Land Binary (LOLBAS). This pattern is indicative of 'UAC Prompt Bombing' used to coerce a user into granting elevated privileges, as seen with the NightshadeC2 loader.
Detects the execution of multiple commands commonly used by Dire Wolf ransomware to delete backups, shadow copies, and event logs, thereby inhibiting system recovery. The rule triggers when more than one of these anti-recovery commands are executed on the same host within a 10-minute window, distinguishing malicious patterns from isolated, legitimate administrative actions.
Detects the execution of an executable or script file from the NETLOGON share. This behavior was observed during the deployment of the Obscura ransomware and is a strong indicator of lateral movement or malicious deployment via Group Policy.
Detects attempts to read the Key Distribution Service (KDS) Root Key from Active Directory. This is often a preliminary step in the Golden dMSA attack, where an attacker with high privileges attempts to retrieve the key material needed to forge tickets for Delegated Managed Service Accounts (dMSA) to establish domain persistence. The rule looks for access to the 'msKds-ProvRootKey' object, identified either by its name or its schema ID GUID 'aa02fd41-17e0-4f18-8687-b2239649736b'.
Detects attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This technique is used by malware like Salat Stealer to bypass security prompts and perform administrative tasks without user approval.
Detects potential DLL hijacking attempts used by DarkVision RAT for privilege escalation. The malware places a malicious 'DXGI.dll' in a non-standard path to be loaded by 'WinSAT.exe'.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects processes associated with AI Waifu RAT or common Living-off-the-Land Binaries (LOLBins) making network connections to localhost. This behavior is indicative of the AI Waifu RAT's C2 and staging mechanisms, which use local ports for command execution and payload delivery.
Detects registry modifications associated with the NotDoor backdoor used by APT28. The malware modifies Outlook registry keys to enable macros on boot, lower security settings, and disable dialog messages to achieve persistence and evade user detection.
Detects the execution of a browser process with the remote debugging port argument enabled. This technique is used by infostealers like Stealerium and Phantom Stealer to bypass browser security and steal credentials and cookies.
Page 88 of 92