Phishing detection rulesT1566

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

windows · registry_set

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

windows · file_event

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

windows · process_creation

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

windows · process_creation

Detects Ursnif C2 traffic.

proxy

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

windows · file_event

Detects the creation of a office macro file from a a suspicious process

windows · file_event

Detects when Okta FastPass prevents a known phishing site.

okta

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

windows

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

windows · process_creation

Detect when System Manager successfully executes commands against an instance.

aws

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

windows · process_creation

Detects a suspicious program execution in Outlook temp folder

windows · process_creation

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

proxy

Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.

windows · file_event

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

windows · process_creation

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

windows · process_creation

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

windows · process_creation

Detects the execution of the hdiutil utility in order to mount disk images.

macos · process_creation

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

windows · process_creation

Detects the mount of an ISO image on an endpoint

windows

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

windows · file_event

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

windows · file_event

Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

m365

Detects when the macOS Script Editor utility spawns an unusual child process.

macos · process_creation

Detects the creation of WebDAV temporary files with potentially suspicious extensions

windows · file_event

Alerts on trust record modification within the registry, indicating usage of macros

windows · registry_event

Detects download of certain file types from hosts in suspicious TLDs

proxy

Detects executable downloads from suspicious remote systems

proxy

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

proxy

Detects web browser process opening an HTML file from a user's Downloads folder. This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users. When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware. During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.

windows · process_creation

Detects the creation of a new office macro files on the systems

windows · file_event

Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.

windows · file_event