BigDog Sparkles
@MrSparkles0 followers12 downloads13 copies1 like127 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
2
1
1
1
1
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Detects the execution of a VBScript file named 'windows_api.vbs' from common public or appdata directories, a characteristic behavior of the GOGITTER malware as part of the Gopher Strike campaign.