Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,259 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Identifies the execution of PowerShell with suspicious base64 decoding activity.
This behavior is often observed during malware installation leveraging PowerShell.
This behavior is often observed during malware installation leveraging PowerShell.
mshta.exe is actively abused by DeepLoad early in the attack chain to reach attacker staging infrastructure.
Detects the creation of specific disguised shortcut (.lnk) files on drives, indicative of DeepLoad's USB propagation mechanism. DeepLoad spreads to adjacent endpoints by dropping over 40 disguised .lnk files onto connected USB drives.
Detects PowerShell unexpectedly spawning specific built-in Windows processes (LockAppHost.exe, makecab.exe, Magnify.exe). DeepLoad uses Add-Type compiled C# to inject into these processes to hide its fileless payload via asynchronous procedure call (APC) injection.
Detects the creation or execution of 'filemanager.exe' in the user's Downloads folder. DeepLoad uses WMI subscriptions that survive standard cleanup to drop this specific credential stealer into the Downloads folder three days after initial infection.
Detects OAuth authorization requests to Microsoft or Google that use the 'prompt=none' parameter in combination with an intentionally invalid or missing 'scope'. This combination is used to force a silent error redirect to an attacker-controlled URI, bypassing some security filters.
Detects a file download where the referrer URL is a Microsoft Entra ID OAuth endpoint returning an error. This pattern is indicative of an attacker abusing OAuth's error-handling redirection mechanism to lead a user to a malicious payload on an attacker-controlled domain.
Detects the installation of a browser extension that requests both the 'declarativeNetRequest' permission and host permissions for 'gemini.google.com'. This specific combination of permissions was the vector for CVE-2026-0628, a vulnerability that allowed an extension to inject code into the privileged Gemini side panel, leading to privilege escalation and unauthorized access to local files, camera, and microphone.
Detects when the Google Chrome process (chrome.exe) reads or creates an unusually high number of files in sensitive user directories within a short time frame. This behavior is indicative of file and directory discovery (T1083) and could be a post-exploitation step of a browser-based attack, such as the Gemini panel hijacking described in CVE-2026-0628, where a compromised browser process is used to access local files outside of its sandbox.
Detects the legitimate 'steam_monitor.exe' loading 'crashhandler.dll' from a non-standard directory like ProgramData. This side-loading technique was observed in campaigns delivering Korplug/GreedyRobin malware, often following initial access via OAuth redirection abuse.
Page 35 of 41