Security Master
@SecMaster0 followers6 downloads55 copies0 likes22,499 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
1
1
Platforms
2
Products / Services
2
MITRE Techniques
1
1
1
1
1
Detects the Notepad++ updater process (GUP.exe) spawning a child process named 'update.exe'. This behavior was observed during the Lotus Blossom supply chain attack where the Notepad++ update infrastructure was compromised to deliver the Chrysalis backdoor.
Detects the execution of NeutralinoJS framework components ('neutralino.exe', 'node.exe') from non-standard directories. This behavior is associated with the EvilAI campaign, where threat actors leverage the NeutralinoJS framework to execute arbitrary JavaScript code for covert data access and process spawning. The detection specifically looks for the '--load-dir-res' argument, which is a strong indicator of a NeutralinoJS application launch, and filters out executions from standard application installation directories to focus on anomalous locations, which can indicate malware masquerading as a portable app or running from a temporary/user location.