Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,495 downloads158 copies3 likes1,726 views
208 detections
Filters
Last updated
All Time
Detection languages
207
1
Categories
80
37
32
22
20
Platforms
171
6
2
1
1
Products / Services
139
61
24
7
7
MITRE Techniques
68
51
43
35
21
Detects the creation of a Windows service named 'RageService' using the sc.exe utility, potentially involving associated binary names like 'RageCore_' or 'win_guard_'. This activity is indicative of persistence mechanisms used by malware or unauthorized tools.
Detects modifications to the AppInit_DLLs or LoadAppInit_DLLs registry values. These values are used to force the loading of specified DLLs into every process that loads user32.dll, a technique used by adversaries for persistence and code injection.
Detects modifications to the 'BootExecute' registry value within the 'Session Manager' key. The 'BootExecute' value, typically set to 'autocheck autochk *', controls programs that execute automatically during the Windows boot process. Adversaries can add arbitrary executables or scripts to this multi-string value to achieve persistence and gain code execution before user logon.
Detects the modification of the 'NoLogOff' registry value under the Windows Explorer policies key. This policy, when enabled, prevents the 'Log Off' option from appearing in the Start menu, which may be an attempt by an adversary to impair user sessions or lock a user into a specific session on a compromised host.
Detects modifications to the Windows Registry 'Winlogon\Userinit' key where the value contains double commas. This pattern is commonly used by attackers to append a malicious executable or script path to the legitimate 'userinit.exe' process, causing the malicious code to execute during every system startup or user logon.
Detects the use of bcdedit.exe to disable automatic Windows recovery or suppress boot failure notifications. Adversaries often perform this action during the impact phase of an attack to prevent system restoration after data destruction or ransomware encryption.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
Detects specific persistence artifacts associated with LARP53RAT, including unauthorized file shortcuts in the Startup folder, modifications to RunOnce registry keys for system recovery, and suspicious scheduled task creation masquerading as Microsoft Edge updates.
Detects rapid file renaming of user-critical documents and media files to an .encrypted extension, indicative of mass file encryption activity typically associated with ransomware.
Page 19 of 21