Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,495 downloads158 copies3 likes1,726 views
208 detections
Filters
Last updated
All Time
Detection languages
207
1
Categories
80
37
32
22
20
Platforms
171
6
2
1
1
Products / Services
139
61
24
7
7
MITRE Techniques
68
51
43
35
21
Detects the creation or connection to a named pipe containing the string 'ChromeAppBoundVIP', a behavior associated with the WEES stealer malware for extracting sensitive information from web browsers.
Detects registry access attempts to the CLSID registration entries for Chrome, Brave, and Edge IElevator COM interfaces. These interfaces are designed for browser-internal maintenance tasks. Adversaries, such as the operators of WEES Stealer, abuse these interfaces by invoking the IElevator DecryptData method via out-of-process COM activation to decrypt App-Bound encryption keys, bypassing standard browser security boundaries.
Detects modifications to the Windows registry key 'DisableTaskMgr' within the 'Policies\System' hive. Adversaries, including the TrymeLocker malware, may perform this action to prevent users from terminating malicious processes using the Task Manager.
Detects unauthorized usage of the Android AccessibilityService 'performGlobalAction' to trigger a 'BACK' operation specifically when the Android Settings application is active. This behavior is indicative of malicious applications attempting to obstruct user attempts to reach the Settings menu to uninstall a malicious package.
Detects the initialization of an Android package installation session using the 'PackageInstaller.createSession' API in conjunction with 'PackageInstaller$SessionParams'. This behavior is indicative of potential silent second-stage APK installation, a technique used by malicious applications to bypass standard installation prompts or deploy additional malicious components.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects instances where a process attempts to access the memory or control flow of a web browser (Chrome, Edge, Brave) using suspicious access rights (0x820), which correspond to PROCESS_VM_WRITE (allowing memory modification) and PROCESS_SUSPEND_RESUME (allowing thread suspension). This behavior is often indicative of process injection or hollowed execution attempts against browser processes.
Detects the deletion of files within the 'Temp\ffox_' directory on Windows systems, a behavior associated with the WEES stealer malware for anti-forensics during the cleanup of staged exfiltration data.
Detects a non-browser process creating a remote thread with a LoadLibraryW start function targeting chrome.exe, msedge.exe, or brave.exe, which is indicative of a suspend-inject-resume technique used to load unauthorized DLLs into a browser process, potentially bypassing browser protections such as App-Bound Encryption.
Detects the execution of the Snowlight dropper (wusvc.exe) masquerading as a Windows Update service. The rule identifies instances where wusvc.exe is spawned by services.exe from an unconventional path, signaling a potential malicious service installation associated with the UNC5221 VSHELL RAT campaign. The payload is known to utilize Hell's Gate/Halo's Gate direct syscall techniques to evade security API hooks.
Page 20 of 21