Ahmed Monsri
@Ahmedmonsri0 followers7 downloads8 copies2 likes136 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Platforms
1
MITRE Techniques
1
1
1
Detection of advanced email-based phishing campaigns targeting users, leveraging multiple evasion techniques including:
Multiple-layer link wrapping using trusted redirectors (e.g., Proofpoint, url.emailprotection, Bitly)
Malicious SVG attachments
Phishing lures in subject lines
Redirect chains via links to credential harvesting pages
Multiple-layer link wrapping using trusted redirectors (e.g., Proofpoint, url.emailprotection, Bitly)
Malicious SVG attachments
Phishing lures in subject lines
Redirect chains via links to credential harvesting pages
This detection scenario focuses on the abuse of legacy .pif (Program Information File) extensions for malware delivery, execution, and persistence on Windows endpoints. Attackers may use .pif files, sometimes with deceptive double extensions or in user-writable folders, to execute arbitrary code, evade user scrutiny, or persist via the registry, exploiting the fact that .pif files are still natively executable on modern Windows systems.
Algorithm:
- Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths).
- Detect execution of any .pif file in user-writable folders.
- Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process.
- Detect registry persistence attempts (Run/RunOnce) by .pif processes.
- Suppress false positives by excluding known dev/test folders and processes.
Algorithm:
- Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths).
- Detect execution of any .pif file in user-writable folders.
- Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process.
- Detect registry persistence attempts (Run/RunOnce) by .pif processes.
- Suppress false positives by excluding known dev/test folders and processes.