Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Mythic C2 over SMB Detection
Cortex XDR
This rule detects potential Mythic C2 activity communicating over SMB. It identifies network traffic using the SMB protocol with a total upload size greater than 360 bytes, originating from and destined for private IP address ranges. The rule then groups these connections by agent hostname, local IP, remote IP, and process image name, flagging instances where three or more such connections occur within a 7-day timeframe, indicating potential beaconing behavior.
This rule detects the use of bitsadmin to download specific Python scripts ('libsystemhealthcheck.py' or 'libcryptopydatasize.py') from the 'inspectguarantee.org' domain. This activity is associated with the COLDDRIVER (Star Blizzard) threat group, which uses BITSAdmin for ingress tool transfer.
Page 24 of 24