Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,531 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects attempts to stop critical services like Veeam and MSSQL, a behavior associated with Cephalus ransomware to ensure successful encryption and hinder recovery.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects outbound HTTP POST requests to the LeakyStealer C2 server 'everstead.group' using a specific user-agent and URI paths.
Detects DNS queries for domains known to be associated with Clop ransomware command and control (C2) or data leak site operations.
Detects child processes spawned by "MicrosoftEdgeUpdateCore.exe" when it is located in the AppData directory. This behavior is characteristic of the LeakyStealer malware executing downloaded payloads or system commands as part of its post-exploitation activities.
Detects the creation of the "EdgeUpdateCore" Run key, a persistence mechanism used by the LeakyStealer malware.
Page 21 of 21