Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,259 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects the staging and installation of the G DATA Avk.exe sideloading set within the unexpected C:\Users\Public\GData\ directory, associated with a Mustang Panda PlugX campaign. This rule specifically looks for the creation of files named "Avk.exe", "Avk.dll", or "AVKTray.dat" in this suspicious public user directory.
Detects the execution of wermgr.exe from a directory other than the standard System32 or SysWOW64 paths. This behavior is indicative of a dropped payload mapped via windir environment variable manipulation, as observed in the MiniPlasma Local Privilege Escalation (LPE) exploit chain.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
Detects the creation of the specific named pipe 'MiniPlasmaWERPipe' utilized by the MiniPlasma Local Privilege Escalation (LPE) proof-of-concept for SYSTEM process communication.
Detects both specific Indicators of Compromise (IOCs) and generic anomalous authentication activity associated with the exploitation of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257).
Detects generic anomalous authentication or unexpected session creation indicative of an authentication bypass vulnerability (CVE-2026-0257) in PAN-OS GlobalProtect. Needs specific endpoint/URI tuning based on actual CVE details once available.
Detects modifications to the 'BlockedApps' registry key within the CloudFiles policy path, specifically looking for symbolic link setups pointing to the Volatile Environment as used in the MiniPlasma LPE exploit.
Detects the upload of an ASPX web shell originating from a specific IP address (124.156.129.151) associated with the OP-512 threat group. The detection specifically looks for POST requests to .aspx endpoints with a user agent containing 'python-requests/2.33.0' in IIS logs.
Page 30 of 41