Jason Nelson
@Jason6 followers485 downloads408 copies62 likes5,220 views
39 detections
Filters
Last updated
All Time
Detection languages
25
7
4
3
Categories
17
16
9
5
5
Platforms
25
10
3
2
1
Products / Services
8
3
3
3
2
MITRE Techniques
20
11
10
10
8
Identifies HTML Application (HTA) file execution from browsers, commonly used in ClickFix attacks to execute malicious scripts while appearing as legitimate web content.
Catches PowerShell processes with both Base64 decoding and network download capabilities, indicating potential remote payload execution typical of advanced ClickFix attacks.
Detects execution of files from Downloads, Temp, or AppData folders by browsers, indicating potential FileFix attacks where malicious files are downloaded and immediately executed.
Identifies unsigned processes creating scheduled tasks, a common persistence mechanism for malware. **Validation**: Very High - Legitimate task creation is typically done by signed system utilities.
Detects high and critical severity correlation events generated by Palo Alto Networks firewalls' automated correlation engine. The correlation engine connects isolated network events and looks for patterns that indicate a more significant event. This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with a high probability that a host on the network has been compromised.
Detects Windows Management Instrumentation Command-line (WMIC) execution from browsers, often used in ClickFix attacks for remote process creation or system manipulation.
Detects Windows Script Host execution of suspicious file types from browsers, often used in FileFix attacks to execute malicious VBScript or JScript files.
Identifies processes creating fake error messages with social engineering text, commonly used in ClickFix to convince users they need to “fix” something by running malicious code.
Detects when the Palo Alto Networks firewall does not block traffic to a URL associated with malware distribution or operation. This typically indicates a lapse in the firewall's threat intelligence or a misconfiguration. An adversary can abuse this by using the unblocked URL to download malware onto a target system, establish a command and control channel, or exfiltrate data.
Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing attacks. An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, deploying malware, or conducting other malicious activities.
Page 3 of 4