Michael Francess
@MFrancessCompletionist
3 followers431 downloads42 copies33 likes596 views
12 detections
Filters
Last updated
All Time
Detection languages
12
Categories
3
1
1
1
1
Platforms
5
Products / Services
3
1
MITRE Techniques
2
2
2
2
2
Detects network connections to known command-and-control (C2) domains used by malicious AI browser extensions for data exfiltration.
Detects browser processes (Chrome or Edge) launched with command lines containing known malicious extension IDs associated with AI chat harvesting.
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
Detects the creation of a directory with a trailing space in its name (e.g., "C:\Windows \") using the NT path prefix `\\?\`. This technique was observed in a Remcos malware campaign in June 2025 to masquerade as a legitimate system directory like `C:\Windows\SysWOW64` to evade detection.
Detects HTTP requests with URL patterns associated with various malicious Traffic Distribution Systems (TDS) as identified in the Infoblox report on VexTrio and related adtech cabals. These TDS are used to redirect users to malicious content, including scams and malware.
Detects network connections to domains and IP addresses associated with the HelloTDS Traffic Direction System (TDS) infrastructure. This TDS is known for delivering FakeCaptcha, tech scams, and other malware by fingerprinting visitors and redirecting them to malicious landing pages.
Detects DNS queries to domains associated with the VexTrio Traffic Distribution System (TDS) and related malicious adtech platforms as detailed in Infoblox research. These platforms are used to redirect users from compromised websites to scams, malware, and other malicious content.
Detects the execution of Chromium-based browsers with command-line flags that automatically accept camera/microphone access or select desktop capture sources, which can be used for spying.
Detects network connections to known TerraStealerV2/TerraLogger C2/exfiltration domains (wetransfers.io, api.telegram.org) initiated by suspicious processes, or the creation of the specific output zip file used by TerraStealerV2.
Detects command-line patterns associated with Atomic Stealer attempting to harvest credentials via fake password prompts using AppleScript and unlocking the macOS Keychain.
Page 1 of 2