g host
@ghosty0 followers2 downloads110 copies4 likes1,378 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
3
3
1
1
1
Platforms
3
1
1
Products / Services
1
1
1
MITRE Techniques
3
1
1
1
1
Detects 'msiexec.exe' being launched from a web browser with a command line containing indicators of remote package download or path traversal. This is a primary indicator of the 'ClickFix' social engineering technique used by LeakNet and other threat actors.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
Detects the anomalous execution of Node.js from non-standard, user-writable directories or when spawned by a shell process. This behavior is indicative of the Tsundere Bot backdoor, often used by TA584. The rule specifically looks for node.exe running from common user-writable or temporary directories (AppData\Local, Users\Public, Temp) or when initiated by command-line shells like powershell.exe or cmd.exe.
This rule detects the creation of a hidden command shell by the 'pdf24.exe' process, a behavior associated with the PDFSIDER malware. Specifically, it looks for 'cmd.exe' being spawned with the '/c' argument by 'pdf24.exe'.