New Analytic Story
- OpenSSL CVE-2022-3602
Updated Analytic Story
- IcedID
- Remcos
- Qakbot
New Analytics
- Azorult
- SSL Certificates with Punycode
- Windows App Layer Protocol Qakbot NamedPipe
- Zeek x509 Certificate with Punycode
Updated Analytics
- Attempted Credential Dump From Registry via Reg exe
- AWS Detect Users with KMS keys performing encryption S3 (thank you Antony Bowesman)
- AWS ECR Container Upload Outside Business Hours (thank you Antony Bowesman)
- BITSAdmin Download File
- BITS Job Persistence
- Common Ransomware Extensions (thank you Steven Dick)
- Creation of Shadow Copy
- Detect Rare Executables (thank you Antony Bowesman)
- Dump LSASS via procdump
- Executables Or Script Creation In Suspicious Path
- Kubernetes AWS detect suspicious kubectl calls (thank you Antony Bowesman)
- O365 Disable MFA (thank you Jamie Windley)
- Office Document Executing Macro Code
- Office Product Spawn CMD Process
- Office Product Spawning Windows Script Host
- Process Creating LNK file in Suspicious Location
- RunDLL Loading DLL By Ordinal
- Suspicious Process File Path