Rule Library

Sigma Rules

9 rules found for "Andreas Braathen (mnemonic.io)"

3,707Total
3,116Detection
451Emerging
137Hunting
Emerging Threathightest

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

LinuxProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threatmediumtest

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

WindowsProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threatmediumtest

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Proxy Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-22518detection.emerging-threats
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threatmediumtest

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-22518detection.emerging-threats
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threathightest

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

WindowsProcess Creation
detection.emerging-threatsTA0002 · ExecutionT1203 · Exploitation for Client Executioncve.2023-38331
Nasreddine Bencherchali (Nextron Systems)+1Wed Aug 302023
Emerging Threathightest

Potential Pikabot C2 Activity

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

WindowsNetwork Connection
TA0011 · Command and ControlT1573 · Encrypted Channeldetection.emerging-threats
Andreas Braathen (mnemonic.io)Fri Oct 272023
Emerging Threathightest

Potential Pikabot Discovery Activity

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

WindowsProcess Creation
TA0007 · DiscoveryT1016 · System Network Configuration DiscoveryT1049 · System Network Connections DiscoveryT1087 · Account Discovery+1
Andreas Braathen (mnemonic.io)Fri Oct 272023
Emerging Threathightest

Potential Pikabot Hollowing Activity

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

WindowsProcess Creation
TA0004 · Privilege EscalationTA0005 · Defense EvasionT1055.012 · Process Hollowingdetection.emerging-threats
Andreas Braathen (mnemonic.io)Fri Oct 272023
Emerging Threatmediumtest

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

paloaltoFile Eventglobalprotect
TA0002 · Executioncve.2024-3400detection.emerging-threats
Andreas Braathen (mnemonic.io)Thu Apr 252024