Aaron Mog
@AaronMogS2S0 followers2,630 downloads339 copies154 likes9,064 views
76 detections
Filters
Last updated
All Time
Detection languages
50
16
10
Categories
19
11
9
8
6
Platforms
28
12
7
5
2
Products / Services
4
4
4
3
3
MITRE Techniques
26
22
22
22
20
CVEs
4
2
1
Detects the execution patterns of the KimJongRAT PE or PowerShell variant loaders, specifically rundll32 executing a DLL from AppData\Local with export 's' or powershell executing '1.ps1' from AppData\Local with '1.log' as an argument.
Detects the initial execution pattern of the APT41 TOUGHPROGRESS malware via a malicious LNK file executing rundll32.exe with a specific command line argument as described in the Google Cloud blog.
Detects the creation of files associated with the DarkCloud Stealer dropper stage, which is an AutoIt compiled executable, as described in the linked CTI. The AutoIt script uses FileInstall() to drop these files before executing shellcode.
Detects attempts by the RedisRaider malware to establish persistence via cron jobs by modifying Redis configuration to write the database to /etc/cron.d. This technique involves setting the 'dir' and 'dbfilename' configuration parameters to target a cron directory and file, followed by a BGSAVE command.
Detects the execution of Active Directory reconnaissance tools (ADRecon, ADExplorer, SharpHound) commonly used by UNC3944 (Scattered Spider) actors during internal reconnaissance phases.
Detects initial PowerShell execution indicative of the Lampion ClickFix threat leveraging download and execution patterns.
Detects suspicious S3 actions by default AWS service roles that may have overly broad S3 permissions, potentially leading to service takeover as identified in Aqua Security's "Shadow Roles" research.
Detects potential execution patterns and file artifacts associated with Venom Spider's TerraStealerV2 and TerraLogger malware, including execution via regsvr32.exe or mshta.exe and creation of specific data files.
Detects suspicious PowerShell command lines often used in the initial stage of the COLDRIVER LOSTKEYS infection chain.
Detects network connections to domains related to the FreeDrain cryptocurrency phishing scheme, leveraging Azure and AWS services for malicious activities as identified by SentinelOne.
Page 7 of 8