Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
Detects the execution of PowerShell or VBScript commands that contain indicators of base64 encoding. This is a common obfuscation technique used by malware like DarkGate to hide malicious payloads, often seen in social engineering campaigns like "ClickFix".
Detects modifications to Windows Registry keys related to Remote Desktop Protocol (RDP) configuration. Malware like DarkGate is known to manipulate these settings to enable or modify RDP for persistence and remote access.
This rule detects successful administrative logins to Fortinet devices (FortiGate, FortiWeb, FortiProxy, FortiSwitchManager) that leverage the FortiCloud SSO mechanism from an IP address not on an allowlist. This could indicate exploitation of CVE-2025-59718 and CVE-2025-59719, which allow for an authentication bypass.
Detects the presence of a file with a specific SHA-256 hash associated with a Linux Sliver TCP Pivot implant. This implant has been linked to the CL-CRI-1036 group and is used as a precursor to 01flip ransomware deployment. The rule searches across file and process events for this high-fidelity indicator of compromise.
This rule detects a specific sequence of commands often used by ransomware, particularly the '01flip' variant, to self-delete after execution. The sequence involves 'ping.exe' for a delay, 'fsutil.exe' to zero out file data, and 'cmd.exe' to delete files. The rule correlates these events within a short timeframe, initiated by the same process on a given device.
Detects the execution of the AutoHotKey interpreter (AutoHotKey.exe) as a child process of common initial access applications like web browsers, Microsoft Office products, or command-line interpreters. This behavior is a key indicator of the latest DarkGate malware infection chain.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
Detects the specific command-line sequence used by the 01flip ransomware on Linux to erase itself from the disk after encrypting files. This involves using 'sleep' for a delay, 'dd' to overwrite the file with random data, and 'rm' to delete it.
Detects the mass creation of the 'RECOVER-YOUR-FILE.TXT' ransom note, a behavior characteristic of the 01flip ransomware. A high count of these notes on a single host is a strong indicator of compromise, suggesting that data has been encrypted for impact.
Detects the creation of suspicious files (e.g., web shells, executables) by a Node.js or Next.js server process. This activity is a common post-exploitation step after a successful RCE, such as from exploiting CVE-2025-55182 (React2Shell), where an attacker drops a backdoor for persistence.
Page 4 of 10