Shafik Punja
@df51shaf1 follower9 downloads9 copies2 likes304 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
1
1
1
1
1
Detects PowerShell execution patterns associated with the "Cache Smuggling" technique. This involves copying browser cache files, searching them with regex for an embedded payload, and then writing and executing that payload. This specific variant was observed being launched by conhost.exe in headless mode to conceal the window.
Detects msiexec.exe attempting to install a package with a .pdf extension. Adversaries may disguise malicious MSI installers as PDF files to evade detection and trick users.