Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads962 copies13 likes34,167 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
This rule detects the execution of package managers by common parent processes (code.exe, cmd.exe, powershell.exe) when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
Attempts to discover running processes on a Windows system using either native utilities or PowerShell commands/API calls. Adversaries often use these methods to gain information about running processes as part of discovery.
Hunting rule, not a drop in detection
Hunting rule, not a drop in detection
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Detects the creation of local user accounts on macOS using the 'dscl' command-line utility, specifically looking for the '-create' action within the '/Users/' directory and the presence of 'UniqueID' or 'IsHidden' parameters. The rule excludes common system-related UniqueIDs (0, 1, 202, 205, 248) to reduce false positives from legit system operations.
Detects the use of the `sysadminctl` utility with the `addUser` or `-addUser` command-line arguments, which can be used to create new user accounts on macOS systems. This activity could indicate an adversary attempting to establish persistences by creating new accounts.
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
Detects the use of the 'setcap' utility with parameters that assign all Linux capabilities to a binary file. This capability can be abused to create a backdoored binary, enabling unauthorized access, privilege escalation, and bypassing security controls.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Detects commands writing to authorized_keys files, a common SSH persistence method.
Page 14 of 38