Awais Munir
@iawaishttps://threatnexus.onlineTrusted contributorCompletionist
15 followers193 downloads1,508 copies159 likes54,085 views
76 detections
Filters
Last updated
All Time
Detection languages
67
9
Categories
18
14
14
10
9
Platforms
69
6
2
2
2
Products / Services
43
13
5
4
3
MITRE Techniques
16
13
12
9
7
CVEs
2
Detects the Blinder Tunnel C2 loop. The loader beacons about every 63 seconds to the GitHub Contents API (profile upload, one-time license read). The newer variant can instead go through a Cloudflare Workers relay that mirrors the GitHub API paths. Both platforms are legitimate, so the signal is the client: the implant install directory, a non-System32 RuntimeBroker.exe, or any binary under AppData\Local\Microsoft\, none of which are real GitHub clients. Known implant hosts and the known relay alert on a single hit. The lookalike-path arm needs 10 or more connections per hour (a 63-second loop produces 100+), which suppresses incidental noise. Depends on RemoteUrl being populated for TLS connections.
Detects NightLedger Command 93, which collects C:\Windows\debug\NetSetup.log alongside a process listing and exfiltrates both to C2. Since DeviceFileEvents does not surface read-class ActionTypes, this query hunts the collection behavior in DeviceProcessEvents: shell commands (type, more, cmd /c) referencing the NetSetup.log path, spawned from the DLL-loader process class consistent with NightLedger's execution chain. NetSetup.log contains domain name, DC hostnames, and join timestamps, high-value AD recon for an espionage actor.
Detects NightLedger Command 36 (screenshot capture) by anchoring the ScreenshotTaken event to the implant's known execution context rather than relying on a blocklist of legitimate tools. NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations (LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
Detects NightLedger's delivery mechanism: the implant is compiled as a malicious SspiCli.dll and co-located with AppVShNotify.exe (a legitimate Microsoft App-V binary). AppVShNotify.exe imports RPCRT4.dll, which delay-loads SspiCli.dll when an authenticated RPC call is made; loading the implant from the working directory rather than System32. Any load of SspiCli.dll by AppVShNotify.exe from outside canonical Windows system paths is a binary-confidence indicator with near-zero false positive rate in production environments.
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
Detects NightLedger Command 36 (screenshot capture) by anchoring the ScreenshotTaken event to the implant's known execution context rather than relying on a blocklist of legitimate tools.
NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations
(LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations
(LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
Detects NightLedger's delivery mechanism: the implant is compiled as a malicious SspiCli.dll and co-located with AppVShNotify.exe (a legitimate Microsoft App-V binary). AppVShNotify.exe imports RPCRT4.dll, which delay-loads SspiCli.dll when an authenticated RPC call is made; loading the implant from the working directory rather than System32. Any load of SspiCli.dll by AppVShNotify.exe from outside canonical Windows system paths is a binary-confidence indicator with near-zero false positive rate in production environments.
Detects NightLedger Command 93, which collects C:\Windows\debug\NetSetup.log alongside a process listing and exfiltrates both to C2. Since DeviceFileEvents does not surface read-class ActionTypes, this query hunts the collection behavior in DeviceProcessEvents: shell commands (type, more, cmd /c) referencing the NetSetup.log path, spawned from the DLL-loader process class consistent with NightLedger's execution chain. NetSetup.log contains domain name, DC hostnames, and join timestamps, high-value AD recon for an espionage actor.
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
Detects enabling of WDigest credential caching (UseLogonCredential=1) in the registry, followed within 6 hours by execution of common credential dumping tools (procdump, Mimikatz, NanoDump, taskmgr + LSASS/MiniDump/comsvcs) on the same host. This pattern is a strong indicator of post-exploitation credential access in high-tempo ransomware operations like Medusa (Storm-1175).
Page 2 of 8