Aamir Muhammad
@AamirTrusted contributorCompletionist
4 followers54 downloads1,030 copies29 likes30,598 views
46 detections
Filters
Last updated
All Time
Detection languages
24
22
Categories
20
18
16
15
13
Platforms
37
7
3
3
3
Products / Services
14
9
6
5
5
MITRE Techniques
27
23
22
21
11
CVEs
1
1
1
This Logic detects the presence of the malicious Chrome extension FreeVPN.One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
A new RoKRAT variant tied to APT37 delivers payloads via oversized LNK shortcuts, executing a two‑stage encrypted shellcode loader that uses steganography to conceal content. The malware achieves fileless execution by injecting into trusted processes (e.g., mspaint.exe, notepad.exe) and hides C2 activity within legitimate cloud storage services such as pCloud, Yandex Disk, and Dropbox, often leveraging hardcoded API tokens.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
This rule detects the presence and activity of PAM-based backdoors on Linux systems by looking for specific SHA256 hashes and filenames associated with known PAM backdoors. It monitors process events, general device events, file events, and image load events on Linux devices.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration).
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
Page 5 of 5