Nermin Smajic
@NeoXS0 followers44 downloads10 copies1 like276 views
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Categories
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
2
1
1
1
Detects HTTP/HTTPS POST requests to known Lumma Stealer C2 domain
Detects the use of fsutil.exe to delete the USN (Update Sequence Number) journal, a technique observed in the ZEROLOT wiper to inhibit system recovery.
Detects the ZEROLOT wiper, a component reportedly used by the Sandworm group. This rule identifies specific artifacts related to its disk wiping functionality.