Marco Moran
@MarcoMHong KongCompletionist
0 followers16 downloads311 copies2 likes607 views
23 detections
Filters
Last updated
All Time
Detection languages
23
Categories
1
1
Platforms
2
1
Products / Services
1
MITRE Techniques
1
1
CVEs
4
4
2
2
2
Detects SLAPSHOT Python proxy daemon and tunneling tool deployed alongside WHIPSHOT on compromised NetScaler appliances
Detects SLAPSHOT Python proxy daemon and tunneling tool deployed alongside WHIPSHOT on compromised NetScaler appliances
This threat hunting query identifies process executions associated with the Shai-Hulud supply-chain campaign by detecting the execution of the known malicious script Math_Symbol.js and references to indicators such as gh-token-monitor and tensorlake within command-line activity. These artifacts have been linked to malicious npm packages used to harvest GitHub credentials and tokens from developer environments, potentially enabling unauthorized access to source code repositories and software supply chains.
Detects command-line activity associated with the ShinyHunters tradecraft involving the validation, execution, and monitoring of the suspicious executable Ple64.exe within the PeopleSoft PSEMHUB.war application directory.
This detection identifies potential Citrix NetScaler persistence and anti-forensic activity associated with CVE-2026-88772. It monitors for suspicious modifications within VPN-related directories and execution of commands indicative of SUID root backdoor creation or Apache web server restart activity, which may indicate efforts to establish persistence, conceal attacker activity, or activate malicious web content.
The detection identifies Linux persistence activity associated with the Cling botnet, where a hidden executable (.cling) is copied to privileged locations, made executable, and registered to run automatically through system startup mechanisms.
This threat hunting query identifies process executions associated with the Shai-Hulud supply-chain campaign by detecting the execution of the known malicious script Math_Symbol.js and references to indicators such as gh-token-monitor and tensorlake within command-line activity. These artifacts have been linked to malicious npm packages used to harvest GitHub credentials and tokens from developer environments, potentially enabling unauthorized access to source code repositories and software supply chains.
This detection identifies potential Citrix NetScaler persistence and anti-forensic activity associated with CVE-2026-88772. It monitors for suspicious modifications within VPN-related directories and execution of commands indicative of SUID root backdoor creation or Apache web server restart activity, which may indicate efforts to establish persistence, conceal attacker activity, or activate malicious web content.
Detects command-line activity associated with the ShinyHunters tradecraft involving the validation, execution, and monitoring of the suspicious executable Ple64.exe within the PeopleSoft PSEMHUB.war application directory.
The detection identifies Linux persistence activity associated with the Cling botnet, where a hidden executable (.cling) is copied to privileged locations, made executable, and registered to run automatically through system startup mechanisms.
Page 1 of 3