Aaron Mog
@AaronMogS2S0 followers2,630 downloads339 copies154 likes9,064 views
76 detections
Filters
Last updated
All Time
Detection languages
50
16
10
Categories
19
11
9
8
6
Platforms
28
12
7
5
2
Products / Services
4
4
4
3
3
MITRE Techniques
26
22
22
22
20
CVEs
4
2
1
Detects a high volume of specific RPC calls from a single source to a single target, indicative of the TorpeDoS technique. This technique is used to cause a denial of service by overwhelming the target with memory-intensive RPC operations.
Detects a process launching from a common user-writable directory that subsequently makes an external network connection. This behavior is consistent with malware, such as the Mythic agent used by RomCom, that performs an execution guardrail check (e.g., verifying the host's domain name) before initiating command and control communications.
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
Detects a packed EDR Killer tool used by multiple ransomware groups like RansomHub, INC, and Medusa. This tool, often packed with HeartCrypt, is designed to disable various security products by loading a malicious driver.
Detects DNS queries for domains known to be used by the DarkCloud campaign for payload delivery and C2 communication. This rule specifically targets domains used for initial payload download, final payload delivery, and public IP address determination.
Detects a malicious JavaScript file used in the DarkCloud campaign. This script uses WScript.Shell to execute an obfuscated PowerShell command, which downloads and executes a second-stage .NET payload.
Detects DNS queries to a command and control (C2) domain used by the AK47C2 backdoor, which is part of the Project AK47 toolset associated with the CL-CRI-1040 (Storm-2603) threat actor.
Detects AK47/X2ANYLOCK ransomware, a tool used by the CL-CRI-1040 threat actor. The rule identifies the malware based on unique PDB paths and embedded ransom note artifacts.
Detects malicious Spotlight Importer (.mdimporter) files designed to bypass macOS TCC protections, as seen in the 'Sploitlight' exploit (CVE-2025-31199). The rule identifies importers that read a file's contents and leak them via logging.
Detects the Chaos ransomware encryptor based on unique command-line arguments and embedded strings.
Page 3 of 8