Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,495 downloads158 copies3 likes1,726 views
208 detections
Filters
Last updated
All Time
Detection languages
207
1
Categories
80
37
32
22
20
Platforms
171
6
2
1
1
Products / Services
139
61
24
7
7
MITRE Techniques
68
51
43
35
21
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Detects the creation of a scheduled task named 'RageGuard' using the Windows schtasks.exe utility. This behavior is indicative of the TrymeLocker malware attempting to maintain persistence on a compromised system by executing with highest privileges upon user logon.
Detects modifications to the 'StubPath' registry value within the 'Active Setup\Installed Components' registry hive. Adversaries use this mechanism to achieve persistence by forcing the execution of arbitrary code when a user logs in.
This rule detects potential persistence mechanisms on Windows systems where a registry run key is configured to launch an executable associated with the RageCore malware or win_guard utility. It monitors for the creation or modification of registry entries within the Windows Run registry keys that reference these specific strings.
Detects the modification of the 'NoFind' registry value within the 'Policies\Explorer' key, which is used to disable the Windows Search functionality for users. Adversaries or unauthorized users may modify this setting to impair system search capabilities or as part of a broader system hardening or lockdown policy.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
Detects TrymeLocker modifying the Image File Execution Options (IFEO) for accessibility binaries to establish a login screen backdoor with SYSTEM privileges.
Page 21 of 21