Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads962 copies13 likes34,167 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects abuse of legitimate Windows binary AgentExecutor.exe, executing powershell scripts. Correlation rule
Detects WMI abuse for lateral movement, remote execution, and persistence
Detects assignment of highly privileged directory roles in Azure AD, including
Global Administrator and Privileged Role Administrator.
Global Administrator and Privileged Role Administrator.
Detects lateral movement attempts using SMB administrative shares
Process Data as source
File running from Recycle Bin
File running from Recycle Bin
Hunting rule for Atomic Red Team T1003 test "Send NTLM Hash with RPC Test Connection" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects setting IsHidden on a macOS user record to suppress the account from the login screen.
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Page 13 of 38