Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,258 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects Matanbuchus Malware Loader (IOCs) including file hashes, a scheduled task name, domains, and an IP address.
Detects the creation of scheduled tasks (event ID 4698) where the task content includes references to potentially suspicious file paths and execution of known Living-off-the-Land Binaries and Scripts (LOLBAS). These behaviors are commonly associated with persistence mechanisms used by threat actors or malware.
KQL Query from file: Potential ClickFix Execution
Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.
KQL Query from file: Detection fake CAPTCHA-based clipboard hijacking
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
This rule detects suspicious creation or modification of Windows Scheduled Tasks via direct changes to the Registry, as captured by Sysmon Event IDs 12, 13, and 14. Adversaries often use this technique to establish persistence by creating malicious tasks that run at system startup or on a scheduled basis. The rule monitors the TaskCache registry paths specifically Tasks and Tree keys and excludes known legitimate operations by trusted system processes and users (e.g., taskhostw.exe, svchost.exe, SYSTEM, and service accounts) to reduce false positives.
Detects various initial access TTPs associated with the "ClickFix" attack vector, where users are tricked into running malicious commands. This includes behaviors observed in Lumma Stealer, Latrodectus, and NetSupport RAT campaigns.
KQL Query from file: Suspicious Stealer Behavior
KQL Query
Page 41 of 41