Rule Library
Sigma Rules
3 rules found for "Gavin Knapp"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionlowtest
Suspicious Network Communication With IPFS
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.
Proxy Log
Gavin KnappThu Mar 16web
Detectionmediumexperimental
Suspicious Non-Browser Network Communication With Google API
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
WindowsNetwork Connection
Gavin KnappMon May 01windows
Detectionlowtest
Potentially Suspicious Network Connection To Notion API
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"
WindowsNetwork Connection
Gavin KnappWed May 03windows