Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,258 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
This rule detects the execution of 'netstat.exe' when initiated by a Python process (python.exe, python3.exe, or pythonw.exe) where the executable is located in non-standard, likely project-specific or virtual environment directories (e.g., 'Scripts', 'bin', 'venv', 'site-packages'). This pattern is often used to execute system binaries from unconventional locations to evade detection or as part of a post-exploitation activity where a script or package includes a malicious or hijacked version of a legitimate system tool.
Detects the use of Python or Pip utilities as parent processes to spawn potentially malicious binaries such as cmd.exe, powershell.exe, curl.exe, or rundll32.exe. This activity is often associated with the execution of downloaded payloads or shell commands directly through package manager workflows.
This rule detects suspicious process lineage where Python (python.exe or pip.exe) is initiating the execution of Windows command shell (cmd.exe) or Windows calculator (calc.exe). This pattern is often associated with exploitation of malicious Python site-hook files or similar techniques where a Python environment is leveraged to spawn secondary processes, potentially leading to unauthorized command execution.
This rule detects potentially malicious command execution patterns where a Python interpreter (python.exe) is invoked with the '-m' flag to execute a module, which subsequently spawns a command shell (cmd.exe) as a child process. This behavior is often associated with adversary attempts to leverage Python's capabilities for system interaction, payload execution, or lateral movement, as documented in various campaigns that abuse Python as a living-off-the-land binary.
This rule detects suspicious PowerShell execution initiated by a Node.js process (node.exe). It monitors for command lines containing common bypass flags (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) and a specific string pattern 'wra-ps-', which is often associated with malicious scripts or remote access trojans (RATs) being executed via a Node.js application.
This rule detects potentially malicious process execution chains where VBScript or unknown/suspicious binaries (such as ProfileQuickHost.exe) are used to launch Node.js processes, specifically targeting JavaScript files or VBScript agents. This pattern is often associated with the execution of remote access trojans (RATs) or custom malware loaders.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
This rule detects interactive or user-triggered execution of PowerShell carrying indicators of payload downloading, inline evaluation, or Base64 encoding. Because explorer.exe is the parent process, it typically signifies a payload delivered via email/web that a user opened directly such as an .lnk shortcut.
This rule detects interactive or user-triggered execution of PowerShell carrying indicators of payload downloading, inline evaluation, or Base64 encoding. Because explorer.exe is the parent process, it typically signifies a payload delivered via email/web that a user opened directly such as an .lnk shortcut.
This rule detects the execution of a malicious PowerShell command chain initiated by explorer.exe, consistent with the PlugX malware infection sequence. The detection monitors for specific command-line arguments, including the use of curl for file downloads, tar for extraction, and the launching of associated malicious executables like 'GRrte.exe' following the execution of a shortcut file named 'OIC_Invitation_General_Official.lnk'.
Page 2 of 41