Browse Rules

TropicTrooper Campaign November 2018

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

TropicTrooper Campaign November 2018

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

System Information Discovery Using System_Profiler

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

TropicTrooper Campaign November 2018

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

AWS EC2 Launch Unusual EC2 Instances

Detect when an actor deploys an EC2 instance with an unusual profile based on your business needs.

Binary Execution from Unusual Location through Shell Profile

This rule identifies a process that executes a binary from an unusual location through a shell profile configuration. Threat actors can establish persistence by altering shell profile configurations to execute malicious commands or scripts upon user login. These modifications cause the shell launched during login to execute the malicious payload, resulting in a sequence where an authentication event is followed by the execution of a payload in a suspicious location.

AWS Console Sign-In WITHOUT Okta Redirect

A user has logged into the AWS console without authenticating via Okta. This rule requires AWS SSO via Okta and both log sources configured.

EC2 SystemsManager Exploitation AWS [snowflake-awscloudtrail]

Identifies execution of API commands for the System Security manager. These profiles can be leveraged to execute arbitrary code on EC2 instances as root/SYSTEM using EC2 Systems Manager. -- Threat Actor Association: LUCR-3

EC2 SystemsManager Exploitation AWS [splunk-ec2]

Identifies execution of API commands for the System Security manager. These profiles can be leveraged to execute arbitrary code on EC2 instances as root/SYSTEM using EC2 Systems Manager. -- Threat Actor Association: LUCR-3

COM Registry Key Modified to Point to File in Color Profile Folder

'This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\. This can be used to enable COM hijacking for persistence. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'

PE file dropped in Color Profile Folder

'This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\. This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'

Nohup Execution followed by Outbound Network Connection

Detects the execution of the Nohup utility pointing to a suspicious or malicious executable path followed by pushing the execution to the background using the "&". Threat actors will utilize the Nohup utility to execute their payloads in a variety of ways but specifically within initial access installer scripts and shell profile persistence. This activity should be considered highly abnormal or malicious.

GTI - Initial Access Broker Alert Detected

Triggers an incident when a GTI Relevance System Alert of type initial_access_broker is ingested. Initial Access Broker alerts indicate that a threat actor is advertising or has sold access (credentials, VPN, RDP, admin panels, etc.) to an organisation that matches your profile. These are high-urgency signals that may indicate imminent compromise or an ongoing breach. Each unique Alert ID is grouped into a single incident.

GSuite Government Backed Attack

Detects Google Workspace warnings of government-backed attacks targeting user accounts, issued only when indicators match nation-state threat actors or APT groups. These sophisticated attacks target high-value individuals using advanced tactics including zero-day exploits, spear-phishing, and social engineering. Successful compromise can lead to persistent access, intellectual property theft, and supply chain attacks.

Process Executed from Downloads Folder - Windows [splunk-edr]

This use case detects the execution of executable files (.exe) that originate from the Downloads folder of any user profile on a system. This technique is commonly used by threat actors who leverage social engineering or phishing campaigns to trick users into downloading and executing malicious software, which can then be used for a variety of malicious purposes such as gaining unauthorized access, data exfiltration, or delivering additional payloads.

Process Executed from Downloads Folder - Windows [splunk-sysmon]

This use case detects the execution of executable files (.exe) that originate from the Downloads folder of any user profile on a system. This technique is commonly used by threat actors who leverage social engineering or phishing campaigns to trick users into downloading and executing malicious software, which can then be used for a variety of malicious purposes such as gaining unauthorized access, data exfiltration, or delivering additional payloads.

Process Executed from Downloads Folder - Windows [splunk-winevent]

This use case detects the execution of executable files (.exe) that originate from the Downloads folder of any user profile on a system. This technique is commonly used by threat actors who leverage social engineering or phishing campaigns to trick users into downloading and executing malicious software, which can then be used for a variety of malicious purposes such as gaining unauthorized access, data exfiltration, or delivering additional payloads.

Possible AiTM Phishing Attempt Against Microsoft Entra ID

'Threat actors may attempt to phish users in order to hijack a users sign-in session, and skip the authentication process even if the user had enabled multifactor authentication (MFA) by stealing and replaying stolen credentials and session cookies. This detection looks for successful Microsoft Entra ID sign ins that had a high risk profile, indicating it had suspicious characteristics such as an unusual location, ISP, user agent, or use of anonymizer services. It then looks for a network connec

Suspicious Terminal Child Process Execution

Detects the execution of a process in a suspicious location by the Terminal application. Terminal will, often times, be granted full disk access by users and administrators who use it. Threat actors are aware of this and will abuse it in order to get their payloads to execute with the same context as Terminal, providing their payload full disk access. They do this by modifying shell profiles (e.g .zshrc, bashrc, etc.) that point to and execute their payload then when Terminal initiates those pro