Effy Elden
@ineffyble3 followers309 downloads101 copies6 likes2,540 views
27 detections
Filters
Last updated
All Time
Detection languages
21
4
2
Categories
12
3
3
3
3
Platforms
19
4
3
2
1
Products / Services
2
1
1
1
MITRE Techniques
14
9
6
6
5
CVEs
1
Detects the execution of AppleScript with the presence of 'character id' in loops. This pattern is often used by malware to hide malicious AppleScript code.
Detects the execution of the specific Linux payload path '/tmp/ld.py', commonly executed via python3 in the background by the dropper associated with the Axios npm supply chain attack.
Detects codesign --sign - used to ad-hoc sign a payload dropped to /private/tmp by a non-system process
Detects the macOS RAT com.apple.act.mond beaconing via HTTP POST with spoofed IE8 User-Agent which was spread via axios supply-chain attack
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
Detects creation of branches and files matching indicators used by Shai-Hulud 2.0 for exfiltration
Detects GitHub Actions activity matching indicators used by Shai-Hulud 2.0 for exfiltration and persistence
Detects screenshot files being created in temp directories by Node.js processes. OtterCookie captures multi-monitor screenshots and stores them as JPEG files before exfiltration.
Page 1 of 3