Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects PowerShell executing certutil.exe to decode base64 files, specifically when a hidden window style is used. This behavior is indicative of the JSE dropper routine employed by the Kimsuky threat group to decode malicious payloads to disk.
Identifies the use of curl to send POST requests to the Kubernetes API targeting the creation of pods. This can indicate an attacker using a stolen ServiceAccount token to deploy malicious or privileged containers.
Identifies the use of the nsenter utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.
Detects the execution of the VSCode CLI (code.exe) with the 'tunnel' argument, particularly when executed from uncommon directories like ProgramData or Users\Public, or when automated via piped input. This technique is actively abused by Kimsuky to establish covert C2 channels that bypass traditional network detections.
Detects network connections to known CountLoader C2 domains based on McAfee Labs analysis. This rule identifies outbound network traffic from devices to a predefined list of Command and Control (C2) domains associated with the CountLoader malware. The detection logic specifically looks for the presence of these domains in the 'RemoteUrl' field of network events.
Detects the execution of wscript.exe or cscript.exe with the '--update' command-line flag, a technique used by the FrostyNeighbor JavaScript dropper to transition to its second execution phase (PicassoLoader).
Detects the creation of scheduled tasks that explicitly call mshta.exe, matching the persistence mechanism of the CountLoader payload launcher.
Detects the installation of the "MANC" service, which is used as a watchdog persistence mechanism for the ClientSetup payload in the TAX#TRIDENT campaign. This rule specifically looks for service installation events where the service name is "MANC".
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Detects the creation of the 'CacheDB' service or specific 'Everything' registry run keys, which are persistence mechanisms utilized by the httpMalice backdoor (a Kimsuky PebbleDash variant).
Page 4 of 13