Marco Moran
@MarcoMHong KongCompletionist
0 followers16 downloads311 copies2 likes607 views
23 detections
Filters
Last updated
All Time
Detection languages
23
Categories
1
1
Platforms
2
1
Products / Services
1
MITRE Techniques
1
1
CVEs
4
4
2
2
2
Identifies command lines where curl downloads executable content to a temporary location and immediately executes it, a technique commonly observed in malware delivery, post-exploitation activity, and exploit-chain payload deployment.
Identifies command lines where curl downloads executable content to a temporary location and immediately executes it, a technique commonly observed in malware delivery, post-exploitation activity, and exploit-chain payload deployment.
This detection identifies processes that exhibit behavior consistent with browser credential and session data harvesting from Chromium-based browsers. Specifically, it looks for command lines containing the Python function shutil.copyfile() used to copy sensitive browser SQLite databases, including Login Data, Cookies, and History, from Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Chromium user profiles.
This detection identifies processes that exhibit behavior consistent with browser credential and session data harvesting from Chromium-based browsers. Specifically, it looks for command lines containing the Python function shutil.copyfile() used to copy sensitive browser SQLite databases, including Login Data, Cookies, and History, from Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Chromium user profiles.
MicroStealer is a newly emerging infostealer that spreads quickly, evades traditional detection, and focuses on stealing corporate credentials, browser data, session tokens, and cryptocurrency wallets. Its layered delivery chain (NSIS → Electron → Java) and heavy obfuscation make it difficult to detect, while exfiltration occurs via Discord webhooks and attacker‑controlled servers.
The detection monitors for the creation or modification of the suspicious systemd service file network-manager.service under /etc/systemd/system/, as well as attempts to enable, start, or restart the service using systemctl.
This hunting query identifies potential persistence mechanisms established through the Windows Run registry key, where a registry value named "MonitorSystem" is created or modified and configured to execute a Python script (.py) at user logon. Such behavior may indicate an attempt by malware or unauthorized software to maintain persistence across reboots by automatically launching a Python-based payload whenever the user signs in.
While reporting has specifically observed the filename agenteV2_historico_detect.py, the detection intentionally searches for the broader .py extension to improve coverage against variations in script naming.
While reporting has specifically observed the filename agenteV2_historico_detect.py, the detection intentionally searches for the broader .py extension to improve coverage against variations in script naming.
This hunting query identifies potential persistence mechanisms established through the Windows Run registry key, where a registry value named "MonitorSystem" is created or modified and configured to execute a Python script (.py) at user logon. Such behavior may indicate an attempt by malware or unauthorized software to maintain persistence across reboots by automatically launching a Python-based payload whenever the user signs in.
While reporting has specifically observed the filename agenteV2_historico_detect.py, the detection intentionally searches for the broader .py extension to improve coverage against variations in script naming.
While reporting has specifically observed the filename agenteV2_historico_detect.py, the detection intentionally searches for the broader .py extension to improve coverage against variations in script naming.
Identifies the creation or modification of files within /etc/cron.d that exhibit suspicious naming conventions, including references to syslog, .log extensions, 59310, or known filenames such as zz-poc59310-syslog.log. The rule is intended to detect potential abuse of the cron scheduling mechanism for persistence, particularly where attackers disguise cron entries as legitimate log files to evade detection.
This detection identifies attempts to create or modify Windows Quality of Service (QoS) policy registry entries under:
HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS
where the configured QoS policy references Microsoft Defender for Endpoint components, including SenseIR, MsSense, WinDefend, or MsMpEng. Such modifications may be indicative of the EDRChoker technique, which abuses Windows QoS policies to throttle network bandwidth or degrade communications associated with Endpoint Detection and Response (EDR) solutions, potentially impacting security monitoring and telemetry collection.
The query captures registry modifications targeting these security-related binaries and provides visibility into the initiating user account, process, command line, and parent process responsible for the change. This activity should be validated to determine whether it was performed as part of legitimate system administration or represents an attempt to impair endpoint protection capabilities.
HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS
where the configured QoS policy references Microsoft Defender for Endpoint components, including SenseIR, MsSense, WinDefend, or MsMpEng. Such modifications may be indicative of the EDRChoker technique, which abuses Windows QoS policies to throttle network bandwidth or degrade communications associated with Endpoint Detection and Response (EDR) solutions, potentially impacting security monitoring and telemetry collection.
The query captures registry modifications targeting these security-related binaries and provides visibility into the initiating user account, process, command line, and parent process responsible for the change. This activity should be validated to determine whether it was performed as part of legitimate system administration or represents an attempt to impair endpoint protection capabilities.
Page 2 of 3