Jamari Donovan
@JDtheHiddenOneCompletionist
0 followers166 downloads5 copies3 likes201 views
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Categories
3
Platforms
2
1
MITRE Techniques
2
2
2
1
1
SPL Query
Detects the execution of PowerShell by (wscript.exe/cscript.exe), specifically targeting a PowerShell script in the C:\Temp directory. This behavior is consistent with the initial stages of the DarkCloud Stealer infection chain where a JS/WSF downloader executes a fetched PowerShell script.
Detects the use of common command-line archiving utilities to compress files with extensions commonly associated with digital certificates and private keys. This behavior can indicate the staging of stolen certificates for exfiltration.
Detects command line obfuscation using carets (^) in Windows interpreters like cmd.exe and PowerShell.
Detects host-based artifacts of the Tomcat remote Kernel Backdoor, specifically the communication between the LKM and the userland component via the /proc/acpi/pcicard file.