Richard Kohler
@djrk01Completionist
0 followers9 downloads22 copies0 likes140 views
24 detections
Filters
Last updated
All Time
Detection languages
24
MITRE Techniques
2
2
Detects compromised users who are disabling windows backups. Seen commonly in pre encryption during ransomware attacks.
Detects rundll32.exe loading a DLL from a user-writable staging directory and invoking its Begin export, a loader pattern used in the Ghost CMS/ClickFix campaign. Since legitimate software rarely loads DLLs from these locations via a Begin export, this is a high-fidelity indicator of malicious proxy execution (MITRE T1218.011).
Detect a user linking the dev/null space to shell histroy file to evade shell command histroy from logging. There are few false positive examples.Follow users command history prior.
Detects a potential remote installation of application through http. Look for suspicious parent processes or unusual application installs.
Page 3 of 3