Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,495 downloads158 copies3 likes1,726 views
208 detections
Filters
Last updated
All Time
Detection languages
207
1
Categories
80
37
32
22
20
Platforms
171
6
2
1
1
Products / Services
139
61
24
7
7
MITRE Techniques
68
51
43
35
21
Detects the execution of VBScript files that use a double extension (.pdf.vbs) via Windows Script Host (wscript.exe or cscript.exe). This technique is commonly used to masquerade malicious scripts as benign PDF documents to deceive users into executing them.
Detects the deletion of a specific file named 'Evernote.zip' located within the 'C:\Users\Public\' directory when executed by Windows Script Host (wscript.exe or cscript.exe). This activity is often associated with the cleanup of second-stage archives used during malicious operations.
Detects the execution of Windows Script Host (WScript.exe or CScript.exe) that creates a file or folder starting with 'Libs_' within the 'C:\Users\Public\' directory. This activity is often associated with attackers staging payloads, configuration files, or tools in publicly writable folders to evade detection.
Detects suspicious file activity where a script or process creates a staging folder within 'C:\Users\Public\' and subsequently writes potential decoy PDF files or compressed archive payloads to that same directory. This behavior is indicative of a dropper or secondary stage malware delivery mechanism utilizing world-writable directories for staging.
Detects instances where the Notepad++ executable is launched from a location within the C:\Users\Public\ directory, specifically when the parent process is a Windows scripting engine (wscript.exe or cscript.exe). This pattern is often indicative of an adversary executing a malicious payload staged in a common public directory using script-based wrappers to bypass execution policy or maintain stealth.
This rule detects instances where Windows script hosts (wscript.exe or cscript.exe) create directories with suspicious naming conventions (starting with 'Libs_' or containing 'Temp Documents') within the 'C:\Users\Public\' directory. This activity is often associated with the staging of malicious payloads or collected data prior to exfiltration or execution.
Detects instances where the Windows Script Host (wscript.exe) spawns a process to open a PDF file located within the Public user's 'Temp Documents' directory. This behavior is indicative of a potential malware staging or execution attempt where an adversary attempts to open a malicious document from a publicly accessible folder to bypass user suspicion or execute malicious content.
Detects VBScript droppers that utilize excessive 'WScript.Sleep' delays to bypass sandbox analysis, often combined with error suppression and downloader APIs to execute malicious payloads.
Detects mass file renaming activity associated with OpnKey ransomware, which appends specific ransom identifiers to files. This behavior is indicative of the encryption phase of a ransomware attack, where files are renamed to reflect the encryption status or to include a unique victim identifier.
Detects the use of the native Windows utility 'wbadmin.exe' to delete the system backup catalog or system state backups. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery by preventing administrators from restoring data from existing backups.
Page 1 of 21