Thiru N
@IamthiruIndiaCompletionist
3 followers220 downloads464 copies23 likes18,732 views
70 detections
Filters
Last updated
All Time
Detection languages
55
8
3
2
1
Categories
26
22
16
10
10
Platforms
45
15
9
7
2
Products / Services
8
5
5
4
3
MITRE Techniques
19
18
18
14
12
CVEs
1
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
This rule detects network requests for specific URI paths and filenames ('css.js' or 'cf.js') known to be used by the ErrTraffic malware distribution framework for delivering ClickFix payloads. It identifies potential command and control (C2) infrastructure by grouping requests based on client IP, source IP, domain, destination IP, and URL.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Generic rule content from file: untitled_rule
Generic rule content from file: MLTBackdoor File Creation
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe, indicating active DSC processing. This is a strong indicator of WinGet DSC execution, which is abused by tools like DSCourier.
Detects DNS requests to known MLTBackdoor command and control and DGA domains. This rule specifically looks for DNS queries to a hardcoded list of domains associated with the MLTBackdoor malware.
Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.
Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.
Page 3 of 7