Kyaw Pyiyt Htet
@MikoyanDee4 followers28 downloads51 copies24 likes11,838 views
7 detections
Filters
Last updated
All Time
Detection languages
7
Categories
2
2
1
Platforms
4
3
1
Products / Services
6
MITRE Techniques
1
1
1
1
1
Detects the execution of eudcedit.exe, the Windows Private Character Editor, which may be abused to bypass User Account Control (UAC) and achieve privilege escalation. Threat actors can leverage this trusted, auto-elevating binary to execute malicious payloads without prompting the user, particularly when UAC settings are permissive.
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
This detection identifies outbound SSL connections where the certificate issuer or subject matches suspicious strings associated with PureRAT infrastructure.
KQL Query
KQL Query from file: .NET Reflection Defense Evasion (Reflective Code Loading)
KQL Query from file: Unmanaged PowerShell Detection
Researchers have identified a recurring issue where API keys, secrets, and authentication tokens are hardcoded within the JavaScript code of popular Chrome extensions. These exposed credentials are easily retrievable by inspecting the extension package, enabling threat actors to abuse associated services.