Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,365 downloads1,865 copies115 likes21,258 views
410 detections
Filters
Last updated
All Time
Detection languages
324
73
9
4
Categories
173
81
52
42
38
Platforms
334
35
17
14
7
Products / Services
195
30
22
18
16
MITRE Techniques
145
111
70
48
43
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects high-volume file/directory enumeration behavior by the PlugX side-loaded process GRrte.exe, consistent with PlugX's use of FindFirstFileW/FindNextFileW/FindFirstFileExW for file and directory discovery (T1083).
This rule detects persistence mechanisms involving the 'JartePortable' application by monitoring Registry Run keys. It flags when a Registry key is created or modified to include a startup entry for 'Jarte.exe' located in 'C:\Users\Public\JartePortable\'. The detection specifically looks for a suspicious registry value data pattern.
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
Detects Adobe Acrobat (Acrobat.exe) launched by a suspicious parent process (GRrte.exe) while opening a specific PDF document from the user's temporary directory. This pattern is indicative of a potential malicious document lure often associated with malware delivery.
Detects the execution of taskkill.exe to forcibly terminate the iediagcmd.exe diagnostic process, initiated by the process GRrte.exe. This behavior is indicative of an attempt to impair security or diagnostic tools on the endpoint.
This rule detects the execution of a malicious PowerShell command chain initiated by explorer.exe, consistent with the PlugX malware infection sequence. The detection monitors for specific command-line arguments, including the use of curl for file downloads, tar for extraction, and the launching of associated malicious executables like 'GRrte.exe' following the execution of a shortcut file named 'OIC_Invitation_General_Official.lnk'.
This rule detects suspicious activity where a node.exe process, often associated with a node-pty terminal emulation, launches common Windows command-line shells (cmd.exe, powershell.exe) from specific file paths or directories. This behavior is indicative of a Node.js-based Remote Access Trojan (RAT) or shell spawning mechanism being used to establish command and control or persistence on a Windows host.
This rule detects persistence mechanisms involving the creation or modification of a specific Windows Registry Run key ('ComponentTask33Agent') within the HKEY_CURRENT_USER hive, or the execution of PowerShell commands targeting this specific registry value. This is indicative of malware, such as the ChainScript Node.js RAT, attempting to maintain access across user reboots by abusing standard Windows autostart configuration points.
This rule detects a correlation between the creation or modification of a specific file name ('nloemfbihmhm') and the subsequent execution of processes from the 'Temp' directory involving related filenames ('kojuyn.ini', 'ogftogcyiblzjccmcbnw.exe', or 'nloemfbihmhm') within a 5-minute window. This behavior is indicative of a multi-stage execution chain, often used by malware to drop and execute secondary payloads.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
Page 5 of 41