Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,259 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects UDP multicast traffic to 224.0.0.255 on port 31339. This traffic is normally used by the PassMark Endpoint utility (BurnInTest) for peer discovery, but has been observed being repurposed by threat actors such as UAC-0184 to establish a stealthy command and control channel.
Detects instances where the Node.js runtime (node.exe) acts as a parent process to command shells or known sideloading executables observed in the Seedworm campaign.
Detects the use of reg.exe to save the SAM, SECURITY, or SYSTEM hives to the Temp directory for offline credential cracking, as observed in Seedworm espionage campaigns.
Detects the execution of a malicious Java process spawned by the Metasploit Confluence plugin, which is often used for remote code execution (RCE) via Confluence vulnerabilities. The rule looks for java.exe spawned from the Confluence directory with specific command-line arguments containing a classpath pointing to the user's Temp folder with a ~spawn prefix and a Payload class.
Detects the use of curl.exe to upload files to sendit.sh, indicative of staging stolen data to a public file-transfer service as observed in Seedworm campaigns.
Detects the execution of the Shai-Hulud malware's dead-man switch mechanism, specifically the 'gh-token-monitor' service or its destructive wipe payload 'rm -rf ~/'.
This rule detects DNS queries associated with the OP-512 threat cluster, specifically looking for requests to 'hcgos.com' and 'lhlsjcb.com'. It identifies a hex-segmented pattern used for reporting web shell deployment locations and also explicitly checks for the 'ashx.lhlsjcb.com' subdomain, indicating potential command and control activity.
Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
Identifies the creation or modification of the hardcoded persistence and staging directory used by the JFMBackdoor malware, specifically 'C:\Users\Public\jfm'. This rule detects file system events within this specific path, indicating potential JFMBackdoor activity.
Page 32 of 41