Vignesh S
@vigneshhCompletionist
0 followers5 downloads48 copies1 like283 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
5
3
2
2
1
Platforms
9
2
2
Products / Services
9
MITRE Techniques
5
3
2
2
2
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Detects any file write event in a user's Downloads folder on Windows endpoints, covering every CrowdStrike Falcon Written event type.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Detects Tor client execution on Windows endpoints, including the tor.exe binary and the Tor client bundled with Brave Browser (Private Window with Tor). Tor can hide command-and-control or exfiltration traffic, and some malware ships or drops a Tor client. To triage, check the parent process, image path, command line and SHA-256 hash, and confirm whether the user is authorized to use Tor.
Detects executable files saved to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints when the file has no company name in its PE version information. Commercial software almost always carries this field, while malware, masqueraded tools and quick custom builds often do not. Detection relies on file signature rather than extension. Portable utilities and internal tools also match, so triage by hash, writing process, file path and download source.
Detects DLL files written to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints. Attackers use these folders to stage a malicious DLL next to a legitimate executable, often from a phishing archive, so the executable loads it via DLL side-loading. Events are grouped by endpoint and path with DLL names, vendor, SHA-256 and the writing process. Installers and portable apps also match, so triage by hash, vendor, writing process and download source.
Detects Portable Executable (PE) files written to a user's Downloads folder on Windows endpoints. CrowdStrike identifies PE files by file signature, so renamed or extensionless executables are caught as well as .exe files. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. Most hits are legitimate installers, so use the rule for hunting or as a pivot. To triage, review the file name, company name, hash, writing process and download source.
Detects Sysinternals executables written to disk on Windows endpoints, identified by the Sysinternals company name in the PE metadata of newly written EXE files. These are legitimate admin utilities, but attackers also copy them to hosts for discovery, process inspection and credential access. The rule shows tool presence only, not misuse, so it suits inventory and hunting. To triage, review the file path, hash, writing process and whether the user is an administrator.
Detects execution of virtualization and container software on Windows endpoints by image name, covering Hyper-V, VMware, VirtualBox, QEMU, Xen, Parallels, WSL, Docker and containerd. Attackers can run payloads inside a virtual machine or WSL instance to hide activity from host-based security tools. Developers and administrators use these tools routinely, so the rule suits inventory and hunting. To triage, check the user, parent process, command line and hash, and whether the host is expected to run virtual machines.
Detects processes reconnecting to a public IPv4 or IPv6 address after at least 7 days of inactivity on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.