Collin Lairamore
@BollinmoreTrusted contributorCompletionist
2 followers37 downloads240 copies8 likes5,396 views
63 detections
Filters
Last updated
All Time
Detection languages
54
7
2
Categories
11
10
10
9
8
Platforms
36
14
10
3
1
Products / Services
8
7
7
6
5
MITRE Techniques
8
7
6
6
5
CVEs
1
IDS Classtypes
7
1
IDS Protocols
4
3
2
PE capability indicators for VSS + raw-NTFS + regf hive credential dumping (T1003.002). Catches tools that dynamically resolve APIs via GetProcAddress and construct device paths at runtime. If used to scan disk, expect a small number of tools that legitimately edit hives, most can be tunned with the optional pe-suppression block inside the rule is enabled.
This is targeted for YARA used in network sensors like Corelight versus scanning the disk.
Windows registry hive (regf format) observed in network file transfer - output of credential-dumping tooling regardless of filename or author. Triggers on SAM, SECURITY, or SYSTEM hives on the wire.
Windows registry hive (regf format) observed in network file transfer - output of credential-dumping tooling regardless of filename or author. Triggers on SAM, SECURITY, or SYSTEM hives on the wire.
This rule detects network connections to the Telegram API endpoint (api.telegram.org) from processes other than common web browsers like Chrome or Edge. This activity could indicate the use of Telegram for command and control, data exfiltration, or other malicious purposes by malware or threat actors.
Page 7 of 7