Awais Munir
@iawaishttps://threatnexus.onlineTrusted contributorCompletionist
15 followers193 downloads1,508 copies159 likes54,085 views
76 detections
Filters
Last updated
All Time
Detection languages
67
9
Categories
18
14
14
10
9
Platforms
69
6
2
2
2
Products / Services
43
13
5
4
3
MITRE Techniques
16
13
12
9
7
CVEs
2
This query detects the specific credential access pattern used by Storm-1175 (Medusa ransomware operators).
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
This query identifies malicious or suspicious browser extensions by cross-referencing multiple high-fidelity threat intelligence sources, including Socket.dev, OX.Security, Koi.ai, and GitLab.io.
This query identifies malicious or suspicious browser extensions by cross-referencing multiple high-fidelity threat intelligence sources, including Socket.dev, OX.Security, Koi.ai, and GitLab.io.
Detects suspicious commands executed via the Windows Run dialog (Win+R) by correlating RunMRU registry updates with the originating process. This hunt is intended to identify user-driven execution techniques commonly observed in ClickFix, FileFix, fake CAPTCHA, and other social engineering attacks.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
This rule detects suspicious Python execution patterns that are commonly abused by attackers. It looks for Python interpreters executing commands inline, from user-writable paths (like AppData, Temp, Downloads), or using suspicious modules/functions (requests, socket, subprocess, base64, ctypes, urllib, exec, eval). Additionally, it identifies Python processes that include indicators of downloading or installing tools (pip install, wget, curl, powershell, bitsadmin). The rule filters out common development tools and system accounts to reduce false positives.
This rule detects suspicious Python command-line executions that involve importing the 'requests' library, using 'exec()' for dynamic code execution, and making HTTP/HTTPS requests. This pattern is often observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects the execution of 'cmd.exe' initiated by common Microsoft Office applications, scripting engines, or msiexec.exe, where the command line includes 'curl' for downloading a '.pdf' file and also attempts to delete files using 'del /s /q'. This behavior is often associated with initial access, download of malicious payloads, and cleanup activities by adversaries. The rule specifically looks for command lines that interact with 'Users\Public', 'conhost.exe', or use the '--headless' flag, which can indicate automated or background execution.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Page 3 of 8