Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects attempts to discover GitHub runner processes (Runner.Worker or Runner.Listener) using process enumeration tools like pgrep, ps, or grep. Adversaries may use this technique to locate processes carrying secrets on compromised CI/CD runners.
Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.
Detects the creation of batch or command scripts in the Windows Startup folder. This is a common persistence technique used by malware like VOID#GEIST (spol.bat) to ensure execution on user logon. The rule specifically looks for file creation events of .bat or .cmd files in the Startup folder, initiated by processes commonly associated with malicious downloads or script execution such as cmd.exe, powershell.exe, curl.exe, cscript.exe, and wscript.exe.
Detects network traffic to known VOID#GEIST C2 domains hosted on TryCloudflare, or the specific command-line execution of `curl.exe` used to send a 'status=success' beacon. This activity confirms a successful compromise by the malware.
Detects 'Early Bird' Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes. This technique involves a suspicious parent process (like a script interpreter) creating a suspended 'explorer.exe' process, then injecting malicious code using API calls such as 'QueueUserAPC' and 'WriteProcessMemory' before the process fully starts. This rule specifically looks for the combination of these events within a short timeframe.
This detection identifies network requests matching a URL pattern used by the Coruna iOS exploit kit to deliver encrypted binary payloads. The framework generates resource URLs using a 40-character hash and serves them as files ending in ".min.js".
This rule detects DNS queries for domains matching the pattern used by the PLASMAGRID implant's Domain Generation Algorithm (DGA). The implant, associated with the Coruna exploit kit, generates 15-character domains with a .xyz TLD as a C2 fallback mechanism.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Detects persistence mechanisms associated with malware signed by TrustConnect Software PTY LTD. The malware establishes persistence by creating a specific Run key or by registering a service masquerading as Adobe Acrobat Reader.
Page 11 of 13