Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects the creation of a specific scheduled task (TempLogA) used by ModeloRAT to establish persistence and maintain SYSTEM-level access on compromised hosts. The rule looks for `schtasks.exe` execution with `/create`, `TempLogA`, and `SYSTEM` in the command line.
Identifies the execution of DumpIt, a memory acquisition tool often abused by attackers to dump LSASS and extract NTLM hashes or Kerberos tickets.
Detects the creation of 'configA.json' by a Python process, which indicates successful host profiling by KongTuke's ModeloRAT reconnaissance module. This file is typically dropped after the reconnaissance phase to store collected system information.
Identifies instances of mshta.exe being used to execute remote payloads over HTTP/HTTPS. This matches the initial ClickFix access vector used in the Amatera Stealer campaign.
Identifies network connections to known C2 and dropper infrastructure associated with the Amatera Stealer 4.0.2 Beta and ClickFix campaign. Network indicators provide a reliable detection mechanism for compromised hosts attempting to download secondary payloads or exfiltrate data.
Detects file access patterns in the Downloads directory matching cryptocurrency wallet seeds, phrases, and private keys targeted by file grabbers like Amatera. The rule identifies bulk access (more than 3 sensitive files within 5 minutes) to files with specific keywords or extensions commonly associated with crypto wallets.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Detects the immediate persistence mechanisms (VBScript and Startup shortcut) established by KongTuke's ModeloRAT within minutes of initial execution. This rule specifically looks for PowerShell execution that contains commands to create both a VBScript file named 'scriptA.vbs' and a Startup shortcut named 'StartManagerB.lnk', which are highly specific indicators of this threat.
Detects script engines (wscript.exe, mshta.exe, cscript.exe) making outbound network connections to Cloudflare Workers domains (*.workers.dev). This is a primary C2 channel utilized by Gamaredon for GammaLoad payload delivery and beaconing.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Page 6 of 13