G'iyosiddin Muxammadiyev
@giyosiddinCompletionist
0 followers22 downloads24 copies0 likes1,212 views
3 detections
Filters
Last updated
All Time
Detection languages
2
1
MITRE Techniques
1
1
1
1
1
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
This detection identifies activity associated with the Lotus Wiper destructive malware campaign, including its orchestration scripts, staging artifacts, and destructive behaviors.
The detection focuses on:
Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\)
Use of batch scripts such as OhSyncNow.bat and notesreg.bat
Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe)
System-level destructive actions including:
Disk wiping via diskpart clean all
File destruction using robocopy /MIR and fsutil file createnew
Network disruption via netsh interface disable
Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount)
Service tampering (e.g., UI0Detect stop/disable)
This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
The detection focuses on:
Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\)
Use of batch scripts such as OhSyncNow.bat and notesreg.bat
Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe)
System-level destructive actions including:
Disk wiping via diskpart clean all
File destruction using robocopy /MIR and fsutil file createnew
Network disruption via netsh interface disable
Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount)
Service tampering (e.g., UI0Detect stop/disable)
This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
This rule detects the use of the 'chmod' command with highly permissive file permissions (777, 0777, a=rwx, ugo+rwx, a+rwx) on Vyatta systems. This activity could indicate an attempt to weaken file system security, potentially for privilege escalation or to facilitate malware execution.