Digit Oktavianto
@digitoktav4 followers122 downloads17 copies10 likes23,192 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
2
Platforms
3
Products / Services
1
1
MITRE Techniques
2
2
2
2
1
A composite detection rule that identifies multiple techniques, tactics, and procedures (TTPs) associated with the RansomHub intrusion detailed in "The DFIR Report". This rule focuses on process creation events and flags the execution of specific credential dumping tools, network scanners, defense evasion commands, ransomware behaviors, and exfiltration tool chains. An alert from this rule indicates a high probability of malicious activity consistent with this threat actor's methodology.
Detects the execution of a remote HTA file using mshta.exe, where the parent process is cmd.exe. This is a common technique for code execution via malicious HTA files.
Detects potential abuse of the Windows on-screen keyboard (osk.exe) by replacing it with cmd.exe or spawning unusual processes as SYSTEM. This technique can be used for persistence via accessibility features.