Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,259 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects network connections to known malicious domains associated with OilRig's steganography-based C2 infrastructure. OilRig C2 Domain Connection malicious domains extracted from OilRig telecom targeting campaign.
Detects the creation of specific payload staging files (filter.bin, kernel-diag.lib) in the anomalous ApplicationData32 directory, a behavior indicative of UAC-0184 staging prior to decoding and execution.
Detects the use of bitsadmin to transfer a payload followed by mshta.exe execution, a pattern observed in UAC-0184 LNK file lures.
Detects the execution of ErsChk.exe or command lines referencing Eraser.dll, which are specific artifacts used by Mustang Panda for malicious DLL side-loading to deploy PlugX.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation
This analytic identifies the instance of rundll32.exe process loading a non-standard Windows modules file extension. This behavior is not common and can be associated with malicious activities. This technique is to evade possible detection by security tools that monitors a suspicious dll loading activity.
Detects instances of PowerShell launching with a hidden window style and subsequently executing the 'tar' command to extract files into the LocalAppData directory, a pattern observed in Mustang Panda loaders.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation
Detects the creation of files within a specifically misspelled 'Photoes' directory located in ProgramData. This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger to store XOR-encrypted keystroke logs (.trn files).
DeepLoad leverages this specific command structure in fake browser prompts to trick users into executing the initial payload.
Page 34 of 41