Josh M.
@jmadson0 followers0 downloads16 copies2 likes281 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
1
1
MITRE Techniques
1
1
1
1
1
This rule detects the execution of hidden shell scripts within the `/tmp/` directory on Linux systems, specifically looking for `nohup` commands that launch a shell (`sh` or `bash`) to execute a hidden `.sh` file (e.g., `.eba9ee1e4.sh`). This behavior is indicative of the UAT-10608 / React2Shell threat, often associated with credential harvesting operations.
Detects network connections to a known Sapphire Sleet (APT38) command and control (C2) IP address and port, or DNS resolution requests for a malicious Sapphire Sleet C2 domain. This rule identifies direct communication with infrastructure associated with the Sapphire Sleet threat actor.