frog 🐸
@frog5 followers19 downloads12 copies18 likes318 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
1
1
1
1
1
Platforms
3
MITRE Techniques
1
1
1
1
1
Looking for several activities that are documented as being part of the initial infection chain for NotDoor (https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/).
Nice as a quick historical check for any potentially interesting things to investigate further.
Nice as a quick historical check for any potentially interesting things to investigate further.
Threat hunting query looking for successful logon events with user agent strings that are uncommon within your environment.
Looking for strings entered into and executed from the Windows run box, which is leveraged by ClickFix campaigns for initial access.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
Looking for processes executing chrome / edge with a remote debugging port, this is typically seen being leverage by info stealer malware to steal credentials.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.