Suraj A
@cytechCompletionist
0 followers115 downloads374 copies2 likes1,149 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects scheduled task creation events where the action uses explorer.exe to access a remote URL or WebDAV resource (such as DavWWWRoot, http://, https://, or SSL paths) or specific threat intelligence IOC hosts. This technique is often used for WebClient priming and forced authentication to capture credentials.
Detects network communication associated with the KNTRAT (NEBULA campaign) command and control infrastructure, specifically identifying connections to a known C2 IP address on ports 443 or 1434, or traffic containing the custom KNTRAT user-agent string in HTTP requests or additional event fields.
Detects network connections associated with UNC7017 AOMEI supply-chain staging and command-and-control (C2) infrastructure, including lookalike staging domains, Alibaba OSS bucket hosts, GCS bucket paths containing 'aomeiupdate', and known C2 IP addresses. Non-browser processes interacting with the cloud storage hosts are flagged to reduce noise.
Detects outbound network connections made by control.exe or explorer.exe to known campaign domains/IP addresses or utilizing a DavWWWRoot WebDAV path, which is indicative of potential command and control communication or data exfiltration.
Detects the presence of known SHA-256 hashes associated with the NEBULA preinstall.cjs dropper and KNTRAT PE across file creation, process execution, and image load events over a 30-day window.
Detects dllhost.exe making an outbound TCP connection to a public IP on a high port without a preceding DNS lookup on the device shortly before. Also checks for known C2 server connections.
Detects web server or PHP worker processes spawning a shell (sh, bash, dash) with the -c parameter under web user accounts, potentially indicating code execution or webshell activity such as the PHP2Shell fake-array destructor hijack.
Detects suspicious behavior involving Terraform provider processes launching shells running update scripts, communicating with malicious lookalike domains or endpoints, or dropping specific files such as safari_updater or session.lock.
This detection identifies attempts by a process to open a handle to a web browser process with memory read permissions (PROCESS_VM_READ). This behavior is often associated with credential theft techniques where an adversary attempts to dump credentials, cookies, or other sensitive information from browser memory.
Detects the creation of a child process from an IIS worker process (w3wp.exe) where the command line contains a long base64-encoded string, and the process is related to Gladinet software. This pattern is highly indicative of post-exploitation activity related to vulnerabilities like CVE-2025-11371.
Page 9 of 9