Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
Detects host-based artifacts associated with AK47/X2ANYLOCK ransomware, such as the creation of specific ransom notes ('How to decrypt my data.txt', 'How to decrypt my data.log') or files being encrypted with the '.x2anylock' extension. This rule identifies both the creation of the ransom note and the encryption of files by monitoring file creation and renaming events.
Detects the ToolShell exploit chain used against SharePoint servers. This exploit involves a POST request to ToolPane.aspx with a spoofed Referer header pointing to SignOut.aspx, which is a key indicator of this specific attack.
Detects the download of a Java Archive (JAR) file initiated by a PDF reader or web browser, specifically from devices located in Uzbekistan. This behavior is characteristic of the Bloody Wolf threat actor's geofenced attacks.
This rule detects the creation of a public GitHub repository with the specific description "Sha1-Hulud: The Second Coming". This is an indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
Detects DLL side-loading techniques used by Project AK47 loaders. This involves legitimate executables like 7z.exe or clink_x86.exe loading malicious DLLs with similar names from the same directory.
Detects a user account creation event followed by that same account being added to a privileged administrative group within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the group addition event.
This search detects the creation of a public GitHub repository with the description "Sha1-Hulud: The Second Coming". This is a specific indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects the download of a Java Archive (JAR) file initiated by a document reader, browser, or email client. This behavior is consistent with the Bloody Wolf threat actor, which uses spear-phishing to trick users into downloading malicious JAR loaders for the NetSupport RAT.
Detects when an administrator or help desk agent resets a user's password or deactivates/resets their MFA factors. This activity, while often legitimate, is a key tactic used by social engineering groups like Muddled Libra (aka Scattered Spider) who are known to 'vishing' (voice-phishing) IT help desks to take over accounts.
Page 7 of 10