Aaron Mog
@AaronMogS2S0 followers2,630 downloads339 copies154 likes9,064 views
76 detections
Filters
Last updated
All Time
Detection languages
50
16
10
Categories
19
11
9
8
6
Platforms
28
12
7
5
2
Products / Services
4
4
4
3
3
MITRE Techniques
26
22
22
22
20
CVEs
4
2
1
Detects the use of curl to silently download a file from a remote server, often initiated by a command-line interpreter. This technique is used by adversaries, such as in the Epsilon Red ransomware campaign, to fetch payloads without user interaction.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
Detects malicious DLLs (ffmpeg.dll, libvlc.dll) used for sideloading by a China-nexus APT in the 'Illusory Wishes' campaign targeting the Tibetan community.
Detects the DLL sideloading of malicious DLLs (ffmpeg.dll, libvlc.dll) by legitimate applications (Element.exe, VLC.exe) as observed in the 'Illusory Wishes' campaign.
Detects PowerShell commands used by Katz Stealer to download an image file containing a steganographically hidden payload, which is then decoded and executed in memory.
Detects process injection into ImagingDevices.exe, a technique observed in the 'Illusory Wishes' campaign to evade detection. The threat actor used trojanized versions of Element and VLC to inject shellcode into this legitimate Windows process.
Detects a specific malicious LNK file used by the Dropping Elephant (Patchwork) APT group to deliver payloads in a campaign targeting the Turkish defense industry.
Detects techniques used by the Dropping Elephant APT group to stage and execute a DLL side-loading attack using VLC Media Player. This includes the execution of VLC from suspicious paths, the use of PowerShell to download and rename payloads into those paths, and the specific scheduled task used for persistence.
Detects known samples of the Katz Stealer infostealer based on their SHA1 file hashes.
Detects network traffic to command and control (C2) servers associated with the Katz Stealer malware, identified by known IP addresses and domains.
Page 4 of 8