Matt Swann
@McswannDenver, COCompletionist
0 followers4 downloads285 copies7 likes473 views
16 detections
Filters
Last updated
All Time
Detection languages
16
Categories
2
1
1
MITRE Techniques
2
2
2
1
1
Nightmare Eclipse released the ShieldBreak Exploit on Aug 11 2026. This exploit is a privilege escalation exploit to SYSTEM leveraging a vulnerability in Windows Defender. Part of this exploit relies on loading the MpClient.dll that Windows Defender uses to perform security scanning. This query looks for evidence of this DLL being loaded by a file not located in a standard Windows Defender-related location. Loading of this file from any other path is anomalous and should be investigated.
This is a two-part detection, with the first portion identifying injected-into processes by suspected malware, and the second portion identifying the previously identified injected process leveraging the DPAPI to decrypt stored secrets within a browser session. Results from this query will identify browser processes who had their encrypted credentials decrypted via DPAPI and read by the malicious process, highly indicative of stealer activity. Users should treat devices returned by this query as having their stored browser credentials compromised and rotate all saved passwords immediately.
This detection catches activity of PowerShell injecting into a remote process. In the source article and ClickFix attack chain analysis, the targeted processes observed were svchost.exe and explorer.exe. However upon testing, a baseline was established to show that PowerShell should not be observed injecting into any other process besides itself via the ActionType of CreateRemoteThreadApiCall.
A consolidated detection query that seeks to identify potentially malicious usage of mshta.exe, a known LOLBin commonly abused by threat actors to proxy code execution. This detection breaks down potentially suspicious mshta.exe usage into a number of categories and displays which category the query hits on in the resultant data. Note that this may require initial tuning to tune out known environment usage of mshta.exe - line 23 exists as a placeholder to add known exceptions.
CornFlake is a newly identified Remote Access Trojan (RAT) attributed to a campaign dubbed CaptiveCrunch, attributed to the APT29 (Cozy Bear, Midnight Blizzard) sub-cluster tracked as Storm-2945. Real intrusion and sandbox dynamic analysis identifies the RAT landing initially as a file called edge_update.exe which, upon execution, copies itself to a binary named svchost32.exe, masquerading as the legitimate svchost.exe binary to evade detection.
Notes: Detection uses the case operator to match surfaced artifacts against source MSRC article and live sandbox detonation artifacts. MSRC reports the malicious svchost32.exe landing in %APPDATA%\svchost32\svchost32.exe, however live sandbox analysis observes the file path being %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe. Case statement checks against both to be safe, as neither should exist in a standard environment.
Also, remember that IoCs such as file names are low on the pyramid of pain. Taking into account MSRC's article showing the attackers using a handful of different lures, the edge_update.exe process name is likely only one of many for the initial implant. I would expect the svchost32.exe process to be slightly higher fidelity, but defenders should not assume that this detection being in place means they are fully covered from CornFlake RAT.
Notes: Detection uses the case operator to match surfaced artifacts against source MSRC article and live sandbox detonation artifacts. MSRC reports the malicious svchost32.exe landing in %APPDATA%\svchost32\svchost32.exe, however live sandbox analysis observes the file path being %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe. Case statement checks against both to be safe, as neither should exist in a standard environment.
Also, remember that IoCs such as file names are low on the pyramid of pain. Taking into account MSRC's article showing the attackers using a handful of different lures, the edge_update.exe process name is likely only one of many for the initial implant. I would expect the svchost32.exe process to be slightly higher fidelity, but defenders should not assume that this detection being in place means they are fully covered from CornFlake RAT.
This detection query hits on 3 separate ways ChochShell attempts to bypass UAC to elevate privileges: leveraging the %windir% Env variable that gets picked up by SilentCleanup running under elevated permissions, sdclt.exe hijack via Windows Backup, and WSReset COM handler key write followed by WSReset.exe spawning to execute the key.
This query identifies a device being added to an Entra ID account following a suspected successful device code phish attempt as evidenced by the sign in method displaying "deviceCodeFlow". Attackers have been known to register a new device shortly after compromising a user account to establish persistence in the form of Primary Refresh Tokens (PRTs) generated by the attacker-controlled device.
Identifies suspicious child process relationships spawning from known abused RMM tools. Reconstructs the process tree identifying first the RMM tool, a malicious command-line tool child ie. CMD or PowerShell, and subsequently identifies a suspicious child process from this command line tool. Ransomware operators and affiliates follow approaches like this once access is gained via a legitimate remote access tool. Tune and/or add tools as needed; this is far from a complete list.
This detection query hits on the main activity of NightMare Eclipse's LegacyHive exploit: Placing both the ntuser.dat and UsrClass.dat offline hive files in a folder path matching the pattern C:\<GUID>. This is part of the overall exploit chain, which leverages symlinks and oplocks, to trick the Windows OS into loading a target user's UsrClass.dat. One should never expect to see either of these files in a folder patch like C:\<GUID>, so identifying these files touching this path is an immediate cause for concern.
This query intends to detect potentially malicious VPN login attempts by categorizing them into either password spray, or brute force / password stuffing attempts. Detection is fully tunable to your environment and observed baseline user behavior.
Page 1 of 2