Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,259 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects the staging of the Lucid Stealer hidden self-copy loader and the SQLite CLI helper binary in the Temp directory. This rule specifically looks for file creation events in the user's Temp directory with filenames matching patterns associated with Lucid Stealer's staging activities: 'winupd_*.exe' for its self-copy loader and '_sq3e_*.exe' for its SQLite helper.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
Detects exploitation attempts of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257) by monitoring for specific Indicators of Compromise (IOCs) including source IPs, machine names, and MAC addresses.
This rule detects PowerShell execution that combines 'irm' (Invoke-RestMethod) or 'Invoke-RestMethod' with 'iex' (Invoke-Expression) or 'Invoke-Expression'. This pattern is commonly used as a download cradle to fetch and execute malicious scripts or stage-2 infostealers, as observed in campaigns like the fake Gemini CLI installation script.
Detects outbound network traffic to a hardcoded Command and Control (C2) IP address and port associated with a specific build of Lucid Stealer malware. This rule identifies potential C2 communication by monitoring network connections for a known malicious IP and port combination.
Identifies active Command and Control communication from infected hosts to known Red Lamassu infrastructure by monitoring network connections to specific C2 domains.
Detects network connections to typo-squatted lure domains, payload hosts, and C2 servers associated with the fake Gemini CLI and Claude Code campaign.
Detects WMI queries targeting the SecurityCenter2 namespace to enumerate installed antivirus products. Attackers, such as Seedworm, use this command shortly after initial access to map out defensive tooling before deploying evasive loaders.
Detects a process access or memory dumping event indicative of MiniDumpWriteDump against LSASS originating from VSLauncher.exe. This behavior is highly anomalous and has been observed by UAC-0184 via DLL sideloading of the PassMark Endpoint DLL (input.dll) for credential theft.
Detects the creation, modification, or renaming of 'btasc.cfg', a configuration file specifically associated with the JFMBackdoor malware. This file is used to store encrypted configuration data necessary for the backdoor's operation.
Page 31 of 41