Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,258 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
This detection identifies attempts by non-browser processes to access credential database files associated with common web browsers, including Chrome, Edge, and Brave. Such activity is commonly leveraged by threat actors to harvest stored credentials for the purpose of lateral movement and further system compromise. Notably, this technique has been observed in campaigns attributed to MuddyWater Operation Olalampo.
Detects network connections from Microsoft Office applications to the Telegram API. This behavior is a strong indicator of compromise, as threat actors like MuddyWater (in campaigns such as Operation Olalampo) use Telegram bots for command-and-control (C2) initiated by malicious macros in documents.
Detects the execution of an executable named 'svchost.com' from the 'C:\Windows\' directory. This is a known persistence and masquerading technique used by the threat actor MuddyWater. The legitimate Windows process is 'svchost.exe' and is located in the System32 directory.
Hunts for Indicators of Compromise (IOCs) associated with the upStage proxyware campaign, which distributes malware via fake software installers (e.g., 7-Zip). This query searches for known file hashes, file paths, and network connections.
Detects the use of netsh.exe to create firewall rules that allow traffic for the upStage proxyware binaries (hero.exe, Uphero.exe) or specific non-standard ports (1000, 1002) used for proxy traffic. This behavior is a key step for the malware to ensure its network communication is not blocked.
// False Positives: Medium. While the file names are specific, rules created for ports 1000 or 1002 could potentially be legitimate for other applications. Review the initiating process and rule details to confirm maliciousness.
// False Positives: Medium. While the file names are specific, rules created for ports 1000 or 1002 could potentially be legitimate for other applications. Review the initiating process and rule details to confirm maliciousness.
Detects attempts to add file paths to Microsoft Defender's exclusion list using WMIC, a specific defense evasion technique identified in the MKDOOR backdoor associated with PeckBirdy campaigns.
Detects the execution of 'Code.exe' from the '%TEMP%\Lightshot' directory. This specific path and filename combination is a strong indicator of the malicious 'ClawdBot' VS Code extension payload.
Detects the execution of mshta.exe or wscript.exe with a command line pattern matching the PeckBirdy C2 framework's API for fetching landing scripts. The pattern consists of a 32-character ID followed by '/hta', '/wscript', or '/html'.
This rule detects suspicious activity related to browser credential theft or staging. It triggers when a non-browser process accesses sensitive browser files (like 'Login Data' or 'Local State') or when temporary artifacts associated with credential stealer activity ('chromeTmp', 'Local State-journal') are created. This behavior is indicative of an attacker attempting to exfiltrate browser-stored credentials.
Detects the creation or execution of files matching known malicious SHA256 hashes associated with a weaponized ScreenConnect installer and a Rust-based loader. This rule identifies the presence of specific known malicious binaries on endpoints.
Page 36 of 41