Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,258 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Detects the creation of keylogger output files by the WinMainSvc component, which is associated with the Crypto24 ransomware group. The keylogger runs as a service via svchost.exe and creates log files in the C:\Windows\tmp\ directory with a specific naming pattern.
Detects possible Lumma infections based on non-browser network connections to TLDs or steamcommunity API as often seen in Lumma infections
Detects the execution of a Bumblebee loader variant which uses rundll32.exe to launch its malicious DLL. This is immediately followed by the spawning of common reconnaissance commands to gather information about the compromised system and domain. This TTP was observed in the attack chain leading to Akira ransomware.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Description: Detects the execution of a signed macOS application that subsequently spawns a script interpreter like osascript, sh, or bash. This behavior is uncommon for many legitimate GUI applications but is a known TTP for macOS malware like Odyssey Stealer, which uses signed droppers to execute malicious scripts for credential theft, persistence, and payload delivery.
Detects the creation of new scheduled tasks through Schtasks.exe, specifically those invoking OpenSSH, which could indicate an attempt to establish a reverse SSH tunnel to a remote attacker's server.
Detects a non-interactive sign-in using a refresh token for the Microsoft Authentication Broker client, targeting the Device Registration Service (DRS) with the 'adrs_access' scope. This specific combination of attributes is highly indicative of an adversary using tools like ROADtools to register a malicious device in the tenant following a successful OAuth phishing attack.
Page 40 of 41