Skip to content

Instantly share code, notes, and snippets.

View Shivammalaviya's full-sized avatar

Shivam Malaviya Shivammalaviya

30 followers · 3 following
View GitHub Profile
@Shivammalaviya
Shivammalaviya / Hunting Chrome VPN Extensions via the Registry install
Created January 11, 2022 14:32
DeviceRegistryEvents
| where (RegistryKey contains @"Software\Wow6432Node\Google\Chrome\Extensions"
and RegistryKey endswith "update_url" and ActionType =~ "SetValue"
and (RegistryKey contains "fdcgdnkidjaadafnichfpabhfomcebme"
or RegistryKey contains "fcfhplploccackoneaefokcmbjfbkenj"
or RegistryKey contains "bihmplhobchoageeokmgbdihknkjbknd"
or RegistryKey contains "gkojfkhlekighikafcpjkiklfbnlmeio"
or RegistryKey contains "jajilbjjinjmgcibalaakngmkilboobh"
or RegistryKey contains "gjknjjomckknofjidppipffbpoekiipm"
or RegistryKey contains "nabbmpekekjknlbkgpodfndbodhijjem"
@Shivammalaviya
Shivammalaviya / Detects Active Directory account lockouts
Created January 10, 2022 08:53
IdentityLogonEvents
| where FailureReason startswith "AccountLocked"
| summarize StartTime = min(Timestamp), EndTime = max(Timestamp), LockoutsCount = count() by AccountUpn, AccountDomain, DeviceName,Application,ISP,IPAddress
@Shivammalaviya
Shivammalaviya / Log4J vuln jar files hunting
Created January 6, 2022 05:22
let Log4J_vulnerablejarfiles = dynamic(["bf4f41403280c1b115650d470f9b260a5c9042c04d9bcc2a6ca504a66379b2d6","58e9f72081efff9bdaabd82e3b3efe5b1b9f1666cefe28f429ad7176a6d770ae",
"ed285ad5ac6a8cf13461d6c2874fdcd3bf67002844831f66e21c2d0adda43fa4","dbf88c623cc2ad99d82fa4c575fb105e2083465a47b84d64e2e1a63e183c274e",
"a38ddff1e797adb39a08876932bc2538d771ff7db23885fb883fec526aff4fc8","7d86841489afd1097576a649094ae1efb79b3147cd162ba019861dfad4e9573b",
"4bfb0d5022dc499908da4597f3e19f9f64d3cc98ce756a2249c72179d3d75c47","473f15c04122dad810c919b2f3484d46560fd2dd4573f6695d387195816b02a6",
"b3fae4f84d4303cdbad4696554b4e8d2381ad3faf6e0c3c8d2ce60a4388caa02","dcde6033b205433d6e9855c93740f798951fa3a3f252035a768d9f356fde806d",
"85338f694c844c8b66d8a1b981bcf38627f95579209b2662182a009d849e1a4c","db3906edad6009d1886ec1e2a198249b6d99820a3575f8ec80c6ce57f08d521a",
"ec411a34fee49692f196e4dc0a905b25d0667825904862fdba153df5e53183e0","a00a54e3fb8cb83fab38f8714f240ecc13ab9c492584aa571aec5fc71b48732d",
"c584d1000591efa391386264e0d43ec35f4dbb
@Shivammalaviya
Shivammalaviya / Detection for command and control server (Sabbath Ransomware)
Created January 4, 2022 17:11
DeviceNetworkEvents
| where ((RemoteIP =~ "45.79.55.129" or RemoteIP =~ "45.146.166.24" or RemoteIP =~ "45.147.230.221" or RemoteIP =~ "45.141.84.182" or RemoteIP =~ "45.147.230.137")
or (RemoteUrl =~ "aequuira1aedeezais5i.probes.space" or RemoteUrl =~ "jeithe7eijeefohch3qu.probes.site" or RemoteUrl =~ "datatransferdc.com"
or RemoteUrl =~ "farhadl.com" or RemoteUrl =~ "markettc.biz" or RemoteUrl =~ "probes.space" or RemoteUrl =~ "tinysidney.com" or RemoteUrl =~ "helpgoldr.com"
or RemoteUrl =~ "frankir.com" or RemoteUrl =~ "greentuks.com" or RemoteUrl =~ "aimee0febai5phoht2ti.probes.website" or RemoteUrl =~ "cofeeloveers.com"
or RemoteUrl =~ "doratir.com" or RemoteUrl =~ "gordonzon.com" or RemoteUrl =~ "probes.site" or RemoteUrl =~ "probes.website"))
@Shivammalaviya
Shivammalaviya / Hunting DiskCryptor process name of dcrypt.exe
Created January 3, 2022 12:53
DeviceProcessEvents
|where ((InitiatingProcessFolderPath endswith @"\dcrypt.exe"
or InitiatingProcessFolderPath endswith @"\dcinst.exe")
or (ProcessCommandLine contains "dcrypt.exe"
or ProcessCommandLine contains "dcinst.exe"))
@Shivammalaviya
Shivammalaviya / Vetted_Log4Shell_IOCs IP Detection
Last active December 21, 2021 18:33
let Vetted_Log4Shell = materialize (
(externaldata(report:string)
[@"https://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/ETAC_Log4Shell_Analysis/ETAC_Vetted_Log4Shell_IOCs.csv"]
with (format = "txt"))
| extend report = parse_csv(report)
| extend Type = tostring(report[0])
| where Type == 'IPv4'
| extend RemoteIP = tostring(report[1])
| extend RemoteIP = replace_string(RemoteIP,'[.]', '.')
| extend Context = tostring(report[2])
@Shivammalaviya
Shivammalaviya / Log4J True Iocs
Last active December 28, 2021 05:08
185.220.101.190
45.129.56.200
209.127.17.242
185.220.101.155
185.220.101.166
87.118.116.103
194.32.107.159
185.220.100.240
199.195.253.149
185.220.100.241
@Shivammalaviya
Shivammalaviya / Log4J detection
Last active December 27, 2021 11:12
let Log4J = materialize (
(externaldata(report:string)
[@"https://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/KPMG_Log4Shell_Feeds/MISP-CSV_MediumConfidence_Unfiltered/Log4j_CrowdSec_ThreatHunt_Feed.csv",
@"https://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/KPMG_Log4Shell_Feeds/MISP-CSV_MediumConfidence_Unfiltered/Log4j_GreyNoise_ThreatHunt_Feed.csv",
@"https://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/KPMG_Log4Shell_Feeds/MISP-CSV_MediumConfidence_Unfiltered/Log4j_Malwar3Ninja_ThreatHunt_Feed.csv",
@"hhttps://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/KPMG_Log4Shell_Feeds/MISP-CSV_MediumConfidence_Unfiltered/Log4j_RedDrip7_AttackIP_ThreatHunt_Feed.csv",
@"https://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/KPMG_Log4Shell_Feeds/MISP-CSV_MediumConfidence_Unfiltered/Log4j_ThreatFox_ThreatHunt_Feed.csv",
@"https://raw.githubusercontent.com/curated-intel/Log4Shell-IOCs/main/KPMG_Log4Shell_Feeds/MISP-CSV
@Shivammalaviya
Shivammalaviya / Log4j
Created December 14, 2021 15:27
1.116.59.211
1.179.247.182
101.204.24.28
103.103.0.141
103.232.136.60
104.248.144.120
107.151.148.53
109.205.176.248
109.237.96.124
109.73.65.32
@Shivammalaviya
Shivammalaviya / Detects exploitation of LPE CVE-2021-41379
Created November 22, 2021 15:15
DeviceFileEvents
| where (InitiatingProcessFolderPath endswith @"\msiexec.exe"
and FolderPath startswith @"C:\Program Files (x86)\Microsoft\Edge\Application"
and FolderPath endswith @"\elevation_service.exe")