Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
Detects python.exe executing from an unusual directory (e.g., a user's 'Contacts' folder) and injecting code into a benign process like notepad.exe. This is a specific behavior observed in the SERPENTINE#CLOUD campaign, where a Python-based loader is used to execute shellcode in memory.
Detects known malicious files associated with the LANDFALL Android spyware by their SHA256 hash. This provides a high-fidelity method for identifying the presence of the spyware on an endpoint.
This rule detects potential DNS command and control (C2) activity from the AK47C2 backdoor. The backdoor communicates by sending long, hex-encoded strings as subdomains to a C2 server, specifically targeting a typosquatted domain of 'updatemicfosoft.com'. The rule identifies these communications by checking for the specific C2 domain, a subdomain length greater than 40 characters, and the subdomain consisting of hex characters with optional prefixes 's', '1', '2', 'a'.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Detects the creation or modification of files, particularly shared objects (.so), on Android devices with overly permissive '777' (rwxrwxrwx) permissions. This behavior is a known tactic of the LANDFALL spyware, which sets these permissions on its staged components like 'dec_a.so' to ensure they are executable.
Detects outbound network connections from common messaging or gallery apps on Samsung Android devices to command and control (C2) infrastructure associated with the LANDFALL spyware.
Detects the execution of an executable file from the AppData\Local directory by the Windows Script Host (wscript.exe or cscript.exe). This behavior is unusual and was observed in the CHAMELEON#NET campaign where JavaScript droppers were used to launch subsequent stages.
Page 10 of 10