Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects gup.exe making DNS queries to domains other than legitimate Notepad++ infrastructure.
Detects DNS queries to known malicious domains used in Notepad++ supply chain attack for C2 communication and payload delivery.
Detects the execution of the Diaoyu Loader, which performs a sandbox evasion check by verifying the existence of a 'pic1.png' file in its execution directory. This behavior is associated with the TGR-STA-1030 threat group.
Detects suspicious child processes spawned by Notepad++ updater (gup.exe) including cmd.exe with reconnaissance commands or scripting engines.
Detects execution of ProShow.exe from AppData directory, indicating potential exploit delivery.
Detects the creation of files or directories containing the string 'swsecret', which is a hard-coded artifact used by the ShadowGuard eBPF rootkit for concealment.
Detects the use of custom kill signals (-900, -901) which are used by the ShadowGuard eBPF rootkit to add or remove a process from its allow-list for kernel-level concealment.
Detects the specific SHA256 hash of a Rust-based DLL loader (DWrite.dll) used for DLL sideloading and redundant payload delivery associated with the 'OpenClaw Agent' malware campaign.
Detects PowerShell or Batch scripts attempting to download files from known malicious C2 domains (darkgptprivate.com, getintwopc.site). This activity is a fallback mechanism associated with the 'OpenClaw Agent' malware campaign
Detects creation and/or attempted execution of C:\ProgramData\CertificationKit.ini, a staging path observed in MuddyWater VBA dropper activity. This rule correlates file creation with suspicious execution attempts (cmd.exe referencing the INI path) on the same host within a short window to increase fidelity.
Page 17 of 21