Thiru N
@IamthiruIndiaCompletionist
3 followers220 downloads464 copies23 likes18,732 views
70 detections
Filters
Last updated
All Time
Detection languages
55
8
3
2
1
Categories
26
22
16
10
10
Platforms
45
15
9
7
2
Products / Services
8
5
5
4
3
MITRE Techniques
19
18
18
14
12
CVEs
1
Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.
Detects the command-line usage of WinGet invoking a configuration file, specifically targeting switches designed for silent, non-interactive execution. This behavior can be indicative of an adversary attempting to install or configure software without user interaction, potentially for persistence, defense evasion, or to establish command and control.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
Detects the creation of files by the "node.exe" process within the ".vscode-server" directory, specifically targeting paths related to user history. This activity could indicate remote file creation via the Visual Studio Code tunnel feature, which might be used for unauthorized access or data transfer.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.
Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.
Page 4 of 7