Taylor Parizo
@axelaratorCompletionist
0 followers22 downloads40 copies4 likes1,039 views
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Categories
2
2
2
1
1
Platforms
5
Products / Services
1
1
MITRE Techniques
2
2
2
2
2
This rule detects outbound network connections from Adobe Reader (AcroRd32.exe) or Adobe Acrobat (Acrobat.exe) processes on Windows platforms to known malicious C2 IP addresses. This activity is indicative of potential compromise, likely stemming from an exploit targeting Adobe products, as observed in a sophisticated zero-day campaign.
Detects the creation of specific executable files (rwdrv.sys, hlpdrv.sys, msimg32.dll) associated with the Qilin EDR killer malware. This rule specifically looks for these files being written to disk, excluding legitimate writes of msimg32.dll to standard Windows system directories to reduce false positives.
Detects outbound network connections initiated by explorer.exe to specific ports (7077 or 62046). This activity is associated with the FAUX#ELEVATE RAT component (RuntimeHost.exe) injecting into explorer.exe for command and control (C2) communications. The rule filters out connections to internal RFC1918 subnets to reduce false positives.
This detection rule identifies a persistence mechanism observed in the Dead#Vax campaign. It detects the Windows Script Host (wscript.exe) being launched by the Task Scheduler engine (taskeng.exe or svchost.exe) to execute a VBScript from a suspicious, user-writable directory such as AppData or a specific ProgramData path like 'ProgramData\IntelDriver'. This behavior is indicative of malicious persistence.
WerFaultSecure should load nearly immediately after EDR-Freeze. This query will correlate PID values instead of time deltas. Since EDR-Freeze requires the PID of an AV/EDR process and WerFaultSecure has to pass a PID to MiniDumpWriteDump so that it can suspend a process, both processes executing will have the same PID in the command line execution. One addition here is to look for the inclusion of dbghelp.dll or dbgcore.dll in the CallTrace field to limit false positive hits.