Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,259 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Detects DNS queries commonly associated with Local LLM (Large Language Model) frameworks or AI-related domains. This activity may indicate unauthorized AI usage or potential data exfiltration channels.
Detects the execution of specific function names commonly associated with the WinPEAS PowerShell enumeration script, often used by adversaries to find privilege escalation paths.
Detects the execution of VSLauncher.exe (Microsoft Visual Studio Version Selector) from the SysWOW64 directory. This behavior is highly anomalous and indicates potential DLL sideloading of input.dll (PassMark Endpoint) by threat actors such as UAC-0184 to repurpose a signed binary's network stack.
Detects file hashes associated with OilRig's custom tools, including the RDAT backdoor variant used in known malicious hashes from the OilRig campaign.
Detects the creation or modification of inbox rules in Exchange, which OilRig uses to hide and manage their steganographic email C2 communications.
Detects the execution of the Bitvise SSH client, which OilRig uses for SSH tunneling and persistent access.
Detects PowerShell script blocks containing WMI queries (Get-WmiObject or SELECT statements) targeting specific Win32 classes commonly used for system reconnaissance.
Detects the execution of dnscmd.exe to enumerate DNS records, which can be used by adversaries to gather internal network infrastructure information.
Detects the execution of the NetSpy network scanning tool, which may be used by adversaries for network discovery and reconnaissance.
Page 33 of 41