Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects network connections to known Command and Control (C2) infrastructure associated with the compromised axios NPM package, which was found to drop a Remote Access Trojan (RAT). The rule specifically looks for connections to the IP address 142.11.206.73 or DNS queries for 'sfrclak.com'.
Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.
Detects a Python-initiated process attempting to read Google Cloud Platform (GCP) credentials by looking for command-line arguments containing 'GOOGLE_APPLICATION_CREDENTIALS' and 'cat 2>/dev/null'. This behavior is indicative of credential harvesting, potentially related to supply chain compromises like the Trivy incident.
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
Detects `curl` commands performing `POST` requests with `--data-binary` that are spawned from a process whose command line contains "trivy-action". This behavior is indicative of potential data exfiltration in the context of a compromised Trivy supply chain.
MicroStealer Network IOCs
Cortex XDR
Detects network communication to known MicroStealer C2 domains or Discord webhook activity with a 'MicroStealer/1.0' user agent. This rule identifies potential MicroStealer malware activity within the network.
This rule detects the execution chain associated with MicroStealer, specifically looking for processes named 'RocobeSetup.exe', 'Game Launcher.exe', or 'miicrosoft.exe' that are involved in actions related to a file named 'soft.jar'. This indicates the potential presence and activity of the MicroStealer malware.
Detects modifications to AWS EC2 security groups that allow SSH (port 22) or RDP (port 3389) access from any IP address (0.0.0.0/0) to instances. This configuration significantly increases the attack surface and can be an indicator of unauthorized access attempts, misconfigurations, or malicious activity.
AWS EC2 GetPasswordData API Call
Cortex XDR
Detects when the AWS EC2 GetPasswordData API call is made. This API call retrieves the Windows administrator password for an EC2 instance, which could indicate an attempt to gain unauthorized access to an instance.
Detects when an AWS KMS key deletion is scheduled from a source that is not identified as an Infrastructure as Code (IaC) tool (e.g., CloudFormation or Terraform). This could indicate unauthorized attempts to destroy cryptographic keys, potentially leading to data unavailability or integrity issues.
Page 18 of 24