Georgios Maragos
@GmarakGreeceCompletionist
2 followers501 downloads300 copies8 likes5,907 views
46 detections
Filters
Last updated
All Time
Detection languages
45
1
Categories
21
14
8
6
4
Platforms
25
10
4
4
4
Products / Services
12
8
5
4
4
MITRE Techniques
18
8
8
8
7
CVEs
3
2
1
1
1
Detects the creation of folders or files associated with the malicious ChatGPT-China and ChatMoss VS Code extensions (MaliciousCorgi campaign). These extensions silently exfiltrate developer source code to external servers.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Detects destructive Linux commands such as recursive root directory deletion (rm -rf /*) and random data disk wiping (dd if=/dev/urandom of=/dev/sdX). This behavior has been observed as payloads in indirect prompt injections targeting LLM agents to destroy host filesystems.
Detects the execution of AnyDesk with flags intended to install it as a persistent service. Legitimate remote monitoring and management (RMM) tools like AnyDesk are increasingly weaponized by threat actors to establish robust, stealthy persistence that evades standard malware detection.
Detects the java.exe (ActiveMQ) process spawning cmd.exe to run certutil for payload delivery. This is highly indicative of CVE-2023-46604 post-exploitation activity, leading to Metasploit and LockBit ransomware deployment.
Detects execution of Impacket's MSSQL client tool, commonly used for lateral movement against Microsoft SQL servers using compromised credentials. Includes detection of proxychains usage and Python-based execution patterns.
Page 5 of 5