Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects the execution of files signed by "TrustConnect Software PTY LTD", a certificate issuer observed signing malware that impersonates legitimate workplace applications to deploy RMM backdoors. This rule identifies processes launched from binaries associated with this suspicious certificate.
This rule detects specific JavaScript obfuscation patterns used by the Coruna exploit kit framework. The kit was observed being used by multiple threat actors, including UNC6353 and UNC6691. The rule looks for two distinct patterns in process command lines: a map/join/fromCharCode obfuscation pattern and an integer XOR obfuscation pattern, typically executed by JavaScript-enabled processes like web browsers or scripting hosts.
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
Detects the execution of legitimate Microsoft binaries, NGenTask.exe or phoneactivate.exe (often renamed), from non-standard, user-writable directories. This is a known DLL Sideloading technique used by the threat actor SloppyLemming.
Detects the creation of a registry run key named 'OneDrive' that points to an executable located within the user's AppData ClickOnce cache directory. This is a specific persistence technique used by the SloppyLemming actor to execute the BurrowShell loader.
Detects the execution of LuaJIT or renamed variants with a single text, log, or JSON file as an argument, a pattern characteristic of the FakeGit campaign's loader. The rule specifically looks for process creation events where the executable name is one of the known suspicious processes (luajit.exe, lua.exe, vm_s390x.exe, init.exe, luad.exe, gcc.exe) and the command line contains a .txt, .log, or .json file extension. It further refines the detection by checking if the command line has a limited number of arguments (2 or 3), which is typical for the malware's simple execution pattern.
Detects the "EtherHiding" technique used by the FakeGit campaign. The malware queries a Polygon Mainnet smart contract via a public RPC node to resolve its current C2 server address. This rule looks for network connections to known blockchain RPC providers containing the specific function selectors used by the malware's V1 and V2 contracts.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
Detects URL click events or browser launches where the URL targets Microsoft or Google OAuth endpoints and contains the combination of 'prompt=none' and 'scope=invalid'. This specific combination is used by attackers to force a silent error redirect to a malicious URI.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Page 12 of 13