Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects PowerShell invoking Add-AppxPackage -Register with a UNC path, the initial trigger in the UNCanny attack chain. A standard user registers a loose-file AppX package from an attacker-controlled SMB share, causing the Windows Store Install Service (running as SYSTEM) to perform a LoadLibraryW call against the remote path.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Identifies instances where curl is used to interact with a mounted Docker Unix socket. This technique is used to issue API commands directly to the Docker daemon, often to deploy new privileged containers for host escape.
Detects file execution where curl.exe or bitsadmin.exe are copied to a public document folder and renamed to DLL extensions (like winhttp.dll or wininet.dll) to evade detection. This activity is associated with the TAX#TRIDENT campaign.
Detects execution of svchost.exe from the non-standard \Windows\SysWOW64\msres\ folder. This behavior is associated with the ClientSetup/SyncFuture payload used in the TAX#TRIDENT campaign to maintain C2 sessions.
Detects the creation or modification of YTSysConfig.ini or YTSysConfig.ytf, which are runtime configuration files for the ClientSetup/Yangtu payload used in the TAX#TRIDENT campaign. This activity indicates potential deployment or configuration of the malware.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Page 3 of 13