Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
This rule detects command-line activity indicative of downloading payloads from a Cloudflare Tunnel (`.trycloudflare.com`). This technique is used by the SERPENTINE#CLOUD threat actor to deliver malicious stages of their attack chain. The rule looks for common download utilities or specific WebDAV paths being invoked by command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects attempts to disable Windows Defender's real-time monitoring feature by modifying its corresponding registry key. This technique is commonly used by malware, such as FormBook RAT, to evade detection.
Detects the creation of image files on endpoints that match the characteristics of the LANDFALL Android spyware delivery mechanism. LANDFALL is delivered via malformed DNG/JPEG files, often through WhatsApp. This activity could represent a user downloading or staging the malicious file on a corporate endpoint before transferring it to a mobile device. The rule looks for specific filename patterns associated with WhatsApp and known malicious file hashes.
Detects network connections from Samsung Android devices that match the Command and Control (C2) patterns of the LANDFALL spyware. The rule identifies high-fidelity connections to known LANDFALL C2 IPs and domains, as well as lower-fidelity behavioral patterns, such as connections over HTTPS to non-standard ports.
Detects network connections to known Command and Control (C2) IP addresses associated with the LANDFALL Android spyware. While the spyware is known to target Samsung Android devices, this rule detects connections from any device to provide broader coverage against infrastructure reuse.
This rule detects potential DNS command and control (C2) activity from the AK47C2 backdoor. The backdoor communicates by sending long, hex-encoded strings as subdomains to a C2 server, specifically targeting the domain 'update.updatemicfosoft.com'. The detection logic looks for DNS queries to this specific domain where the subdomain is longer than 40 characters and consists of hex characters, optionally prefixed with 's', '1', '2', or 'a'.
Detects the creation of VBScript or Batch files in the Windows Startup folder. This is a common persistence technique used by various malware families, including the scripts (`pws1.vbs`, `PWS.vbs`, `startuppp.bat`) dropped by the SERPENTINE#CLOUD campaign.
Detects the initial execution phase of the CHAMELEON#NET campaign, where specific obfuscated JavaScript files (e.g., POP2.js, adobe.js, svchost.js) are dropped into a temporary directory and then executed by a script host like wscript.exe or cscript.exe. The rule correlates file creation events of these suspicious JavaScript files in the user's temporary directory with their subsequent execution by wscript.exe or cscript.exe within a short timeframe.
Detects the execution of a command pattern associated with malicious .lnk files used in the SERPENTINE#CLOUD campaign. The threat actor uses a .lnk file to launch cmd.exe, which then uses robocopy to download a .wsf script from a WebDAV share hosted on a Cloudflare Tunnel, and finally executes it with cscript.exe.
Page 9 of 10