Vaasudev K
@SIEMThatComing1 follower18 downloads49 copies3 likes604 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
2
1
1
1
1
Platforms
5
1
1
Products / Services
3
3
MITRE Techniques
1
1
1
1
1
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
Detects modifications to the default program associated with .txt files, specifically looking for changes to the 'open' command or 'UserChoice' registry keys. This can be indicative of an adversary attempting to establish persistence or execute malicious code when a user opens a text file.
This rule detects the execution of known Remote Monitoring and Management (RMM) tool processes or network connections to domains associated with RMM tools. It leverages an external CSV file containing a list of RMM tool executable names and their associated domains to identify suspicious activity. The rule aims to identify the presence and use of legitimate RMM software, which can be abused by adversaries for remote access and control.
Guildma malware (also known as Astaroth), has been observed abusing the legitimate Windows colorcpl.exe tool in a cunning way. According to SANS ISC, the malware first uses colorcpl.exe to silently copy bitsadmin.exe into the writable C:\Windows\System32\spool\drivers\color\ directory, avoiding the typical copy command that security tools might detect. Once relocated, Guildma executes this copy of bitsadmin.exe from the less-scrutinized path to download additional payloads, effectively sidestepping traditional detection mechanisms that monitor only the original binary location.
Shimcache flushing refers to the deliberate clearing or manipulation of the Application Compatibility Cache on a Windows system, which stores metadata about executables that have been run. This cache is valuable for forensic investigations because it provides evidence of program execution, even if the original binary has been deleted. Flushing shimcache could be considered suspicious because it is rarely performed during normal system operations and is often used by attackers to hide their tracks. By wiping this artifact, threat actors attempt to prevent incident responders from identifying which tools or malware were executed on the compromised system. This behavior is typically associated with anti-forensic techniques used by advanced persistent threats, malware, or red team operators.