New Detection Rules Feed

This rule detects brand impersonation of Fastway Couriers, a delivery services company. It triggers on inbound emails where the sender's display name contains 'fastway' or is a close Levenshtein distance match to 'fastway couriers'. To reduce false positives, the rule excludes emails from legitimate Fastway root domains, ignores messages from high-trust domains that pass DMARC, and filters out senders previously associated with benign or solicited correspondence. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566, T1598

credential-access malicious-activity TA0001 T1566 T1598 MIT License

This KQL query hunts for potentially malicious network activity originating from airport locations. It monitors `DeviceNetworkEvents` for connections initiated by scripting tools like `powershell.exe`, `curl.exe`, or `wget.exe` to web resources over HTTP/HTTPS. The core detection logic correlates the device's local IP address with a list of known airport geographical coordinates to identify suspicious behavior that could indicate a user connected to a spoofed Wi-Fi hotspot or fell victim to a click-fix attack. Relevant MITRE ATT&CK tactics: TA0001, TA0002 Relevant MITRE ATT&CK techniques: T1557, T1204, T1059.001

network-security malicious-activity execution TA0001 TA0002 T1557 T1204 T1059.001

This rule identifies PowerShell scripts that utilize the 'Set-MpPreference' cmdlet with specific parameters to disable or modify Windows Defender security features. Such actions are a common defense evasion technique used by attackers to weaken endpoint protection before executing malicious payloads, thereby avoiding detection. Relevant MITRE ATT&CK tactics: TA0005, TA0002 Relevant MITRE ATT&CK techniques: T1562, T1562.001, T1059, T1059.001

defense-evasion endpoint-security execution TA0005 TA0002 T1562 T1562.001 T1059 T1059.001 Elastic License 2.0

Detects impersonation of Squarespace by analyzing sender display names. The rule triggers when a display name is an exact match or has a Levenshtein distance of less than 2 from 'squarespace', while the sender's domain is not a legitimate Squarespace or Shipstation domain, or if it is, it fails DMARC authentication. It also excludes emails from highly trusted domains that pass DMARC. Relevant MITRE ATT&CK tactics: TA0001, TA0005 Relevant MITRE ATT&CK techniques: T1566, T1036

malicious-activity credential-access defense-evasion TA0001 TA0005 T1566 T1036 MIT License

This YARA rule detects the VIPKeyLogger malware payload. The detection logic identifies files that begin with the MZ header (a standard for Windows executables) and contain specific wide strings such as "/ VIP Recovery \\", "Clipboard Logs ID", and "Keylogger". The presence of all these strings within a PE file is indicative of the VIPKeyLogger. Relevant MITRE ATT&CK tactics: TA0009, TA0006 Relevant MITRE ATT&CK techniques: T1056.001, T1056.002

malicious-activity endpoint-security TA0009 TA0006 T1056.001 T1056.002 GNU General Public License v3.0

This KQL query detects the addition of a custom security attribute definition within an attribute set in Microsoft Entra ID. The detection queries the `AADCustomSecurityAttributeAuditLogs` for the specific `OperationName`. Monitoring this activity is important as custom security attributes can be used to manage authorization and access control, and their modification could indicate privilege escalation or persistence attempts. Relevant MITRE ATT&CK tactics: TA0004, TA0003 Relevant MITRE ATT&CK techniques: T1098

privilege-escalation persistence TA0004 TA0003 T1098 MIT License

This KQL query detects suspicious Multi-Factor Authentication (MFA) registration activity by identifying users who register or modify their security information from an IP address not seen in their sign-in history over the past 30 days. The query correlates recent MFA-related audit logs with historical sign-in data from Azure AD. It specifically filters out activity from new user accounts (created within the last 60 days) and from IP addresses belonging to a predefined internal range to reduce false positives. Relevant MITRE ATT&CK tactics: TA0005 Relevant MITRE ATT&CK techniques: T1556

credential-access defense-evasion TA0005 T1556

This YARA rule detects the GodRAT malware on Windows systems. The detection logic is based on three conditions: the presence of the string "C++/WinRT version" combined with a specific import hash; a pattern matching a generic SSE-optimized XOR decryption routine that uses specific NT API names like NtCreateSection; or a distinct import hash associated with an AES-encrypted variant of the malware. Relevant MITRE ATT&CK tactics: TA0005, TA0002 Relevant MITRE ATT&CK techniques: T1027, T1055, T1219

malicious-activity endpoint-security TA0005 TA0002 T1027 T1055 T1219 Detection Rule License (DRL) 1.1

This KQL query collects Windows Defender Application Control (WDAC) events from Microsoft Defender for Endpoint. It filters the 'DeviceEvents' table for actions related to code integrity, blocked scripts, and audited scripts, providing visibility into application control policy enforcement and potential violations. Relevant MITRE ATT&CK tactics: TA0005, TA0002 Relevant MITRE ATT&CK techniques: T1059, T1204

endpoint-security compliance TA0005 TA0002 T1059 T1204 MIT License

This rule detects post-exploitation activity on macOS systems. It identifies sequences where a process is initiated by an SSH service (`ssh`, `sshd`, or `sshd-session`) and is either a common interpreter like `curl` or `wget`, or is an unsigned/untrusted binary. The detection is triggered if this process execution is followed by an outbound network connection within 15 seconds, indicating potential data exfiltration or command and control communication. Relevant MITRE ATT&CK tactics: TA0002, TA0011 Relevant MITRE ATT&CK techniques: T1059, T1059.004, T1021.004, T1105

execution command-and-control endpoint-security TA0002 TA0011 T1059 T1059.004 T1021.004 T1105 Elastic License 2.0