Threat Hunting
4
Active Campaigns
127
Total Findings
38
Rules Generated
256
Queries in Library
Active Campaigns
APT29 Cozy Bear Activity
Adversary is using WellMess malware for initial access via spear-phishing and leveraging LDAP queries for discovery
Living off the Land Binaries
Threat actors are abusing LOLBins (certutil, mshta, regsvr32) for defense evasion and execution
Cloud Token Theft
Attackers are stealing OAuth tokens from compromised workstations to access cloud services
Ransomware Precursors
Pre-ransomware activity including Cobalt Strike beacon deployment and lateral movement via PsExec/WMI
Query Library
Suspicious PowerShell Encoded Commands
T1059.001Detects PowerShell processes launched with base64-encoded commands commonly used by threat actors.
LDAP Discovery Queries
T1087.002Identifies processes performing LDAP queries to enumerate domain accounts and groups.
Certutil Download Cradle
T1140Detects certutil.exe being used to download and decode files, a common LOLBin abuse technique.
OAuth Token Theft via Browser
T1528Identifies suspicious access patterns to browser token stores that may indicate OAuth token theft.
PsExec Lateral Movement
T1021.002Detects PsExec-style lateral movement by monitoring SMB connections and named pipe creation.
Cobalt Strike Beacon DNS
T1071.004Detects potential Cobalt Strike DNS beaconing by identifying high-frequency DNS queries with suspicious patterns.