Chris Parczyk
@W4tch70w3rCompletionist
1 follower2 downloads75 copies6 likes3,030 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
3
1
1
1
1
Platforms
2
2
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
2
1
1
1
1
Detects the execution of the public Proof-of-Concept for the "Dirty Frag" Linux Kernel Privilege Escalation vulnerability. It monitors for the specific command-line flags '--force-esp' and '--force-rxrpc', as well as the execution of /bin/sh or /bin/bash with the TERM=xterm environment variable, which is indicative of the PoC's payload.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects suspicious command line interpreters or downloaders stored in the Windows RunMRU registry key. This technique is often used in ClickFix attacks where users are socially engineered into pasting malicious commands into the Windows Run dialog.