Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,246 copies160 likes55,587 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the use of .NET deserialization gadgets, often associated with malware loaders like Remcos RAT, by monitoring process command lines for specific keywords such as 'ObjectInputStream', 'DeserializeObject', 'BinaryFormatter', or 'NetDataContractSerializer'. It further refines detection by looking for processes with file names starting with 'GST' or specifically 'Optimax.dll', which are indicators of the Remcos loader.
Detects file events related to potential Remcos RAT loader activity, specifically looking for files with names starting with 'GST' or containing 'GST_' and within a specific size range (1KB to 1000KB). This pattern is indicative of a known Remcos RAT loader.
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
Detects network connections to known IP addresses associated with Remcos RAT loader infrastructure, identified by specific URL patterns indicative of loader-as-a-service operations. The rule triggers if a device makes 3 or more requests to these URLs within an hour.
Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
This rule detects when a single process account initiates the deletion of 10 or more executable (.exe), dynamic link library (.dll), or system (.sys) files within a 5-minute window on a device. This behavior can be indicative of malicious activity such as malware cleanup, anti-forensics, or an attempt to disrupt system functionality.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Page 755 of 866