Akshay Gaikwad
@AkshayGaikwwadCompletionist
1 follower91 downloads12 copies2 likes524 views
8 detections
Filters
Last updated
All Time
Detection languages
8
Categories
5
3
3
2
1
Platforms
8
Products / Services
3
2
MITRE Techniques
5
3
3
3
3
Detects the execution of the Deno runtime with specific command-line arguments used by the LeakNet group to execute a base64-encoded JavaScript payload directly in memory. This "Bring Your Own Runtime" (BYOR) technique helps evade file-based detections.
Detects the sideloading of libvlc.dll or hostfxr.dll when VLC.exe or WingetUI.exe are executed from the non-standard C:\ProgramData\PolGuid\ directory, a TTP associated with the Dust Specter APT group.
Detects the creation of scheduled tasks with specific names and command-line patterns associated with the BadPaw PowerShell backdoor. This technique is used by the threat actor to establish persistence on the compromised system.
Detects the DLL side-loading of 'BugSplatRc64.dll' by 'wsprint.exe' from the 'C:\ProgramData' directory. This is a specific technique used by the China-nexus actor UAT-9244 to load the TernDoor backdoor.
Detects the loading of malicious DLLs (e.g., "propsys.dll", "batmeter.dll") by legitimate Windows binaries ("Fondue.exe", "mblctr.exe", etc.) from non-standard, user-writable locations.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
Detects Node.js package managers (npm, yarn, pnpm) spawning suspicious child processes like network utilities or shells during the installation of a package. This TTP is abused by malicious packages like 'ambar-src' which use 'preinstall' lifecycle scripts to download and execute secondary payloads.
Detects attempts to access or exfiltrate the Active Directory database (NTDS.dit) using the 'print.exe' utility. This specific technique was observed in post-exploitation activities following the compromise of SolarWinds Web Help Desk servers.
Detects suspicious child processes spawned by the SolarWinds Web Help Desk (WHD) service. This behavior was observed during the active exploitation of vulnerable WHD instances as reported by Microsoft.