Parth Parmar
@Cipherom1 follower19 downloads41 copies0 likes797 views
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Categories
4
2
2
Platforms
3
2
1
Products / Services
3
1
1
1
MITRE Techniques
3
2
2
2
2
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects when a common web server process (node, nginx, apache, apache2, httpd) spawns `curl` or `wget`. This behavior is a strong indicator of post-exploitation activity, as seen in the exploitation of vulnerabilities like CVE-2025-55182 (React2Shell), where attackers download second-stage payloads.