Ravi Asakapalli
@RavishankaraskpCompletionist
0 followers7 downloads30 copies2 likes3,170 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
4
3
3
2
2
Platforms
6
2
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
5
5
2
2
2
Detects installation or execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets).
Detects network connections to known suspicious domains or IP addresses
Detects variable splitting technique in cmd.exe to obfuscate PowerShell invocation.
Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning.
Detects files with paths matching known malicious extension IDs
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation