Kumaresan Selladurai
@KumaresanSelladuraiCompletionist
0 followers1 download89 copies0 likes540 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
3
1
1
1
1
Platforms
5
1
1
Products / Services
4
3
1
MITRE Techniques
3
2
2
2
1
IDS Classtypes
2
2
IDS Protocols
1
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
This detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
his query hunts for Beagle malware indicators by correlating suspicious file artifacts (NOVupdate.exe, avk.dll, Claude.msi), process command-line executions, and potential network callbacks. It unifies multiple telemetry sources to surface persistence, DLL sideloading, and C2 activity aligned with MITRE ATT&CK techniques.
his detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.