Aaron Mog
@AaronMogS2S0 followers2,630 downloads339 copies154 likes9,064 views
76 detections
Filters
Last updated
All Time
Detection languages
50
16
10
Categories
19
11
9
8
6
Platforms
28
12
7
5
2
Products / Services
4
4
4
3
3
MITRE Techniques
26
22
22
22
20
CVEs
4
2
1
Detects the "ClickFix" tactic used by the Kimsuky group, where users are tricked into executing malicious PowerShell commands. This includes techniques like reverse-string obfuscation and the use of specific junk strings to evade detection.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
Detects the execution of the NightEagle APT group's Chisel-based malware, SynologyUpdate.exe, with specific command-line arguments indicating C2 communication and proxy functionality. This malware is used for internal network penetration and data exfiltration.
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
Detects the execution of mshta.exe to fetch and run remote scripts, a technique used by TAG-140 for initial access and loading the BroaderAspect loader and DRAT V2. This activity is often initiated via social engineering lures.
Detects the execution of PowerShell by a Microsoft Office application. This behavior is consistent with the UAC-0001 (APT28) campaign described by CERT-UA, where a malicious document's macro was used to launch PowerShell for installing the BEARDSHELL backdoor and COVENANT C2 framework components.
Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.
Detects network connections utilizing specific URL paths associated with Prometei botnet malware distribution and command-and-control (C2) communication.
Page 6 of 8