Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects creation of logAzure.txt, the relative configuration
file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID,
application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.
file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID,
application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.
Detects Chrome or Edge being launched in headless mode with the
remote debugging port flag enabled. msaRAT (Chaos ransomware) uses this to spawn
a hidden browser instance it then manipulates via Chrome DevTools Protocol (CDP)
to inject JavaScript, hijack browser functionality, and build a covert WebRTC
C2 channel that never touches the network directly from the malware process.
remote debugging port flag enabled. msaRAT (Chaos ransomware) uses this to spawn
a hidden browser instance it then manipulates via Chrome DevTools Protocol (CDP)
to inject JavaScript, hijack browser functionality, and build a covert WebRTC
C2 channel that never touches the network directly from the malware process.
Detects a process loading AzureCommunication.dll, the .NET Native AOT-compiled Outlook-calendar C2 module used by Project CAV3RN. The controller (uxtheme.dll) resolves this DLL's single export, QueryInterface, and passes it a get_;;_<agent-id>_,_<legacy-url> or
send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading
pattern that has no legitimate purpose on a host.
send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading
pattern that has no legitimate purpose on a host.
Detects curl.exe writing an MSI package into the ProgramData
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
Detects creation of a GUID-named directory directly at the filesystem root (e.g. C:\{8-4-4-4-12 UUID}). LegacyHive creates this world-writable staging directory to hold a modified ntuser.dat hive and to anchor the NT object directory symbolic link chain used in the privilege escalation. The directory is created with an Everyone:GENERIC_ALL DACL and is removed during cleanup, giving it a short-lived footprint. Requires Sysmon Event ID 11 or equivalent file telemetry.
Detects the COM hijacking persistence used by the MuddyWater-linked PatchAgent loader chain: cloud.dll registers itself under the campaign-specific CLSID {7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32 via DllRegisterServer, so any later COM instantiation of that CLSID re-loads and re-executes the Stage 1 dropper. The CLSID is a hard, campaign-unique indicator.
Detects creation of Windows registry hive files (ntuser.dat or UsrClass.dat) outside the expected user profile path hierarchy. LegacyHive writes a modified ntuser.dat to a GUID-named staging directory at C:\ root (e.g. C:\{GUID}\ntuser.dat) and copies UsrClass.dat there as well to set up the oplock-based race condition. Any hive file materialising outside C:\Users\ or C:\Windows\ is a strong indicator of this exploit chain or equivalent offline hive manipulation.
Detects DNS resolution or network connections to command-and-control domains associated with ACR Stealer campaigns observed in mid-2026 intrusion chains. ACR Stealer exfiltrates browser credential stores (Login Data, Web Data) and beacons to short-lived infrastructure hosted under .icu, .sale, .cc, .com and .art TLDs. Any observed communication to these domains indicates an active infection.
Detects the PatchAgent persistence mechanism used by MuddyWater-linked PatchAgent loader chain: a copy of the loader written to %APPDATA%\Microsoft\PatchAgent\svc_upd.exe combined with a HKCU...\CurrentVersion\Run\PatchAgent registry value pointing to that binary with -p/-k arguments. This specific path and value name combination is distinctive to the campaign's persistence stage.
Detects rundll32.exe execution loading a DLL from a remote WebDAV share over HTTPS, including pushd-mounted WebDAV shares and @SSL/DavWWWRoot UNC indicators. Observed as the initial execution stage of ACR Stealer's Campaign 1, where a ClickFix prompt launches cmd.exe which invokes rundll32.exe against a GUID-based WebDAV path to fetch and load a malicious DLL.
Page 8 of 21