Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads980 copies47 likes69,149 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Monitors for unexpected process termination or instability events associated with the Windows Netlogon service or lsass.exe (Event IDs 1000, 7031, 7034). This may indicate a failed buffer overflow exploitation attempt related to CVE-2026-41089, which could lead to a denial of service.
MiniPlasma PoC Registry Artifacts
Cortex XDR
Detects the creation of specific registry keys in the .DEFAULT user hive associated with the MiniPlasma (CVE-2020-17103) proof-of-concept exploit. This exploit is a privilege escalation vulnerability.
Detects the execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets). The rule specifically looks for process creation events involving npm, node, or yarn, and then filters for command lines containing specific malicious package names identified in threat intelligence.
Detects the axois-utils phantom bot persistence mechanism attempting to modify the Windows Run registry key with the value 'SystemUpdate' pointing to a Node application. This rule specifically looks for registry set value events where the value name is 'SystemUpdate', the key path contains 'CurrentVersion\Run', and the data contains 'node', indicating an attempt to establish persistence by executing a Node.js application at user login.
Phantom Bot Systemd Service Persistence
Cortex XDR
Detects Linux persistence mechanisms specifically associated with the creation or execution of the 'phantom-bot.service' systemd service, used by the axois-utils phantom bot to execute DDoS attacks. The rule looks for process creation events on Linux where the command line contains 'phantom-bot.service' and the process name is 'sh', 'bash', 'systemctl', or 'node'.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
Detects anomalous Microsoft Entra ID sign-in events where the application accessed is the Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e) and the User-Agent indicates a Node.js automated backend ('node' or 'undici'). This combination strongly suggests Tycoon2FA operator polling for device-code token acquisition.
Phantom Bot Task Persistence
Cortex XDR
Detects the creation of a scheduled task named 'SystemUpdate' calling the node executable, an indicator of the 'axois-utils' phantom bot persistence. This rule specifically looks for `schtasks.exe` being used with `/create`, `SystemUpdate`, and `node` in the command line.
Tycoon2FA Domain Network Traffic
Cortex XDR
Detects DNS queries or network connections resolving to known Tycoon2FA credential harvesting, kill switch, and link management domains post-takedown. This rule specifically targets precise indicators of compromise (IoCs) associated with the rebuilt Tycoon2FA infrastructure.
Tycoon2FA Kit URL Parameters
Cortex XDR
Identifies network traffic containing the distinct 'bltpg' and 'sid' parameters used by the Tycoon2FA credential harvesting platform. This rule specifically looks for HTTP network data containing both 'bltpg=' and 'sid=' within the action_network_http field, which are indicative of the Tycoon2FA phishing kit's communication patterns. The rule then deduplicates alerts based on agent hostname and remote IP to reduce alert volume.
Page 1 of 30