Amit Ambekar
@Amit007Completionist
0 followers14 downloads48 copies0 likes143 views
21 detections
Filters
Last updated
All Time
Detection languages
18
3
Categories
11
4
3
3
3
Platforms
21
Products / Services
15
1
1
1
1
MITRE Techniques
10
6
5
5
4
Detects instances where the Kaspersky antivirus process (avp.exe) spawns potentially malicious or administrative binaries like cmd.exe, powershell.exe, or specific artifacts related to 'HardBreacher'. This behavior is highly irregular as antivirus software typically does not initiate these types of processes under high-privilege tokens.
Detects potential exploitation attempts involving the NVIDIA global shared memory object (GreenSection) identified as \BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}. The rule monitors for processes performing memory section operations (e.g., NtMapViewOfSection) in conjunction with driver-related command-line indicators or associated malicious process names, which may indicate an attempt to trigger a crash in nvoglv64.dll or exploit driver-level vulnerabilities.
Detects anomalous access to specific memory sections associated with Desktop Window Manager (dwm.exe) followed by a crash of the same process within a 30-minute window. This behavioral pattern is often indicative of exploitation attempts targeting DWM memory management to achieve code execution or privilege escalation.
Detects the 'LegacyHive.exe' process initiating child processes running under the SYSTEM account context. This behavior is indicative of potential privilege escalation or malicious persistence mechanisms where a process spawns a child with elevated permissions.
This rule detects instances where a process loads 'offreg.dll' (Offline Registry Library) and concurrently accesses the SAM (Security Account Manager) file. This is a common technique used by attackers to offline-extract local account hashes without using standard registry tools, potentially bypassing basic monitoring of 'reg.exe'.
Detects the execution or initiation of a process named 'PrettyPrague.exe' while running with SYSTEM level privileges (AccountSid: S-1-5-18) from directories associated with Avast antivirus software. This activity is indicative of potential privilege escalation or malicious activity masquerading within legitimate security software paths.
Detects attempts to crash or terminate the Kaspersky Antivirus process (avp.exe), as well as associated events indicating the service has been stopped or is encountering abnormal fault conditions. This behavior is indicative of an adversary attempting to disable security software.
Detects anomalous access to specific registry keys under SYSTEM\CurrentControlSet\Control\Lsa that are associated with LSA secrets. The rule monitors for multiple registry operations (set, create, delete) performed by processes other than standard Windows system processes (lsass.exe, svchost.exe, winlogon.exe, services.exe), which is often indicative of credential dumping attempts.
This rule detects the presence of HardBreacher proof-of-concept executables or DLLs containing the string 'SolidSnake.dll'. This identifier is associated with the payload delivery mechanism for a Kaspersky Endpoint Security exploit.
This rule detects the loading of specific, known-vulnerable kernel drivers (based on their SHA256 hashes) when triggered by administrative command-line utilities such as cmd.exe or powershell.exe. This behavior is highly characteristic of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, where adversaries exploit vulnerabilities in legitimate, signed drivers to gain elevated (often SYSTEM or kernel) privileges.
Page 2 of 3