Aamir Muhammad
@AamirTrusted contributorCompletionist
4 followers54 downloads1,030 copies29 likes30,598 views
46 detections
Filters
Last updated
All Time
Detection languages
24
22
Categories
20
18
16
15
13
Platforms
37
7
3
3
3
Products / Services
14
9
6
5
5
MITRE Techniques
27
23
22
21
11
CVEs
1
1
1
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects suspicious activity involving the writing of both DLL and EXE files to the same path, followed by process masquerading (where the file name differs from the original file name) and subsequent DLL side-loading. It also attempts to identify the source URL if the Mark-of-the-Web (MOTW) is present, indicating a downloaded file. The detection chain tracks the process that writes the files, the parent process that initiates the file write, the process that performs the DLL side-load, and finally the loaded DLLs themselves, including various module load telemetry classifications.
This rule detects the creation or modification of services, registry keys, or driver loads that exhibit characteristics associated with the ValleyRAT malware. Specifically, it looks for services or registry entries pointing to executables in common temporary directories (Users, ProgramData, Windows AppData\Local\Temp, or \Temp\) and driver loads from similar temporary paths. It also includes a specific check for drivers signed by 'Shandong Anzai Information Technology' and known SHA256 hashes associated with ValleyRAT. The rule excludes legitimate Symantec AV components and a Lenovo signed driver to reduce false positives.
This rule detects various indicators associated with the 'Fake Clawdbot VS Code Extension' malware, which is known to install the ScreenConnect Remote Access Trojan (RAT). Detection logic includes suspicious domain names, specific file names downloaded from those domains or Dropbox, known malicious IP addresses, specific SHA256 hashes of malicious files, outbound network connections on port 8041 (excluding common private/reserved IP ranges), ScreenConnect service installations/starts, and suspicious file writes or process executions from temporary directories related to ScreenConnect or 'Code.exe'.
This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.
This rule detects a combination of suspicious activities indicative of multi-stage malicious operations. It identifies GUP.exe beaconing to command and control (C2) servers, execution of known malicious hashes (SHA256 and SHA1), connections to C2 IP addresses and domains, suspicious filenames, DLL side-loading attempts, suspicious script/code execution, data exfiltration via curl, reconnaissance commands (whoami, tasklist, systeminfo, netstat), secondary payload writes, and initial malicious execution originating from gup.exe or temporary directories.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
KQL Query from file: threat-hunt-rokrat-malware---injection-and-steganography.kql
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects the presence or execution of files identified by specific SHA256 hashes or file names associated with PAM-based backdoors on Linux systems. It monitors device events, file events, process events, and image load events for these indicators. The rule aims to identify the 'Plague' PAM-based backdoor or similar malicious PAM modules.
Page 3 of 5