Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,258 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects the execution of rar.exe to create a password-protected archive with a known password, or the use of curl.exe to exfiltrate data to known HoneyMyte infrastructure. This TTP is associated with the group's script-based data collection and exfiltration activities.
Detects the creation of a file named '___unique_id___' in a temporary directory. This file is a specific host artifact created by the PeckBirdy framework to store a persistent victim identifier for tracking purposes.
This rule detects network connections to known malicious IP addresses and domains, as well as the presence of files with known malicious hashes. It specifically looks for indicators associated with the Amatera Stealer, including specific domains, an IP address, and file hashes. The rule correlates network events (DeviceNetworkEvents) and file events (DeviceFileEvents) to identify these indicators of compromise (IOCs).
This rule detects the execution of specific child processes (write.exe, cmd.exe) when initiated by a predefined list of parent processes (Sang.exe, googleupdate.exe, vlc.exe, clreg.exe, Nlasvr.exe, qutppy.exe) and when the parent process command line contains certain keywords ('install', 'work', 'passuac'). This pattern can indicate suspicious activity, potentially related to malware installation, persistence, or command and control.
Detects PowerShell scripts attempting to perform image steganography by loading System.Drawing assemblies and calling functions like GetPixel or LockBits to extract data. This technique was observed in an Amatera Stealer campaign where payloads were hidden in PNG files hosted on public CDNs.
Monitors for the creation of 'C:\ProgramData\AppxProvisioning.xml'. The updated CoolClient backdoor, used by the HoneyMyte APT group, uses this specific file path to store XOR-encrypted clipboard and active window monitoring data.
This rule detects the creation of a process where the parent process is 'node.exe' (associated with Node.js, often used by VS Code extensions) and the child process is either 'ScreenConnect.ClientService.exe' or has 'ScreenConnect' in its command line. This behavior could indicate a VS Code extension spawning a ScreenConnect remote access tool, which might be malicious.
Detects PowerShell execution initiated by the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs'. This technique is used as a LOLBIN to proxy malicious PowerShell commands, as seen in campaigns delivering Amatera Stealer.
This rule detects network connections to a predefined list of malicious domains, many of which are hosted on Vercel and appear to be associated with phishing campaigns. The domains often mimic legitimate services or financial documents, suggesting an attempt to deliver malware or steal credentials through phishing. The rule specifically looks for these domains in the 'RemoteUrl' field of 'DeviceNetworkEvents'.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
Page 37 of 41