Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
Contributors
5
1
1
Categories
6
3
2
2
2
Platforms
7
Products / Services
5
2
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects Grixba infostealer activity associated with the Play Ransomware group. The rule monitors for network host and share enumeration using net.exe and WMIC, and tracks the execution of the Grixba binary GT_NET.exe from the non-standard path C:\Users\Public\Music\.
Detects the Grixba infostealer (associated with Play ransomware operations) by identifying the loading of the XOR-encrypted payload 'inf_g.dll' from commonly abused directories like Temp, AppData, ProgramData, or the Public folder, particularly when the file is unsigned.
Detects the loading or execution of the Grixba infostealer payload 'inf_g.dll' or processes executing from the known Grixba RDP drop path located at 'C:\Users\Public\Music\'. Grixba malware, associated with the Play ransomware group, often disguises its components to appear like legitimate software (e.g., SentinelOne). The rule filters out legitimate module loads occurring from authorized SentinelOne installation paths to reduce noise.
Detects the execution of the Grixba infostealer, associated with the Play Ransomware group, which is known to perform ntdll EDR unhooking. The rule specifically monitors the launch of the identified malicious binary (Gt_net.exe or GT_NET.exe) from the C:\Users\Public\Music\ directory, a behavior observed consistently across Grixba versions.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
This rule detects the staging (creation, modification, or renaming) and subsequent execution of executable files (.exe) within the 'C:\Users\Public\Music\' directory. This folder is an unusual location for executables and is often leveraged by adversaries for staging malicious payloads to evade detection. The rule specifically references 'Grixba' and 'Play Ransomware' in its context, suggesting it targets behaviors associated with these threats.
This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
