Aaron Shelmire
@ashelmire3 followers303 downloads86 copies19 likes1,094 views
11 detections
Filters
Last updated
All Time
Detection languages
7
4
Categories
2
2
1
1
1
Platforms
7
1
Products / Services
3
1
1
1
1
MITRE Techniques
5
4
3
2
2
Detects PowerShell execution patterns consistent with the ClickFix malware campaign, which uses obfuscated scripts to decrypt and reflectively load a .NET assembly in memory. This activity is detailed in Stage 2 of the infection chain. The query identifies command lines with combinations of keywords used for decoding, decryption, and in-memory execution, specifically looking for 'FromBase64String' combined with 'Reflection.Assembly' and 'Load' for reflective loading, 'FromBase64String' and '-bxor' for XOR decryption, or 'FromBase64String' and 'Invoke-Expression'/'IEX' for executing decoded scripts in memory.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
Detects network communication patterns associated with the SparkKitty mobile spyware, which exfiltrates sensitive data, including images, by connecting to known command and control servers or using specific API endpoints.
Detects the creation or modification of a registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, a common persistence mechanism used by DarkCloud Stealer.
KQL Query
Detects the creation or modification of an Active Directory forest trust where the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag is set in TdoAttributes. This includes cases where it's set alone (0x800) or in combination with the FOREST_TRANSITIVE flag (0x808), both indicative of the AORTA attack. For more comprehensive detection, consider backend-specific bitwise checks on TdoAttributes to ensure the 0x800 bit is set, regardless of other flags.
Detects the Skynet malware's specific behavior of dropping and executing a Tor client with unique command-line arguments in the temporary directory.
Detects the creation or modification of an Active Directory forest trust with only the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag set in TdoAttributes. This indicates the AORTA attack where TGT delegation is enabled without the trust also being marked as transitive. This complements the detection for the 0x808 value.
Detects the Skynet malware's specific behavior of dropping and executing a Tor client with unique command-line arguments in the temporary directory.
Page 1 of 2