Sergiu B
@Sergiu0 followers2 downloads23 copies0 likes58 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
1
1
1
1
1
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
This rule detects scenarios where 'MpClient.dll' is loaded by a process that is not a recognized Microsoft Defender security process, and this load event occurs in close temporal proximity to the creation or modification of 'ShieldCrash_' artifacts. This pattern is indicative of potential DLL side-loading or defense evasion activities, where an adversary attempts to masquerade malicious activity using components associated with security product internals or crash reporting mechanisms.