S@1@N .
@kohtetCompletionist
1 follower441 downloads47 copies9 likes22,673 views
21 detections
Filters
Last updated
All Time
Detection languages
21
Categories
11
4
3
1
1
Platforms
20
MITRE Techniques
14
10
6
5
4
Detects Snipping Tool abuse through the ms-screensketch protocol with a UNC path in the filePath parameter, which may trigger outbound SMB authentication and NTLM hash leakage.
Detects exploitation attempts for CVE-2026-33829 where the Snipping Tool ms-screensketch URI schema is abused with a remote UNC path in the filePath parameter, potentially coercing SMB authentication and leaking Net-NTLM credentials.
Detects creation of hero proxyware files in SysWOW64 directory.
Detects creation of a scheduled task named Microsoft\Windows\Defrag\CorelDefrag configured to execute an obfuscated PowerShell payload on a daily basis. This task mimics a legitimate Windows Defrag task to maintain persistence.
Detects deletion of eScan antivirus components, including the Remote Support Utility (tvqsapp.exe), preceded or accompanied by creation of ZIP backups in C:\ProgramData\esfsbk. This behavior may indicate malicious tampering or defense evasion associated with eScan supply chain compromise.
Detects modification of eScan antivirus database-related registry values, such as setting WTBases_new to an abnormal value (e.g., 999) under the ODS registry key. This behavior may prevent signature updates or force the antivirus engine into an inconsistent state.
Detects behavior consistent with an AMSI bypass where the AmsiScanBuffer function is located and patched in memory to always return an error. This technique disables script content scanning and is commonly used by post-exploitation frameworks and staged malware payloads.
Detects PowerShell retrieving, decoding, and executing a payload stored inside the Windows registry.
Detects replacement or modification of the eScan CONSCTLX.exe component located in C:\Program Files (x86)\eScan\. Replacing this binary may allow execution of a persistent next-stage payload under the guise of a trusted antivirus process.
Detects execution or presence of a maliciously replaced eScan component reload.exe distributed via a compromised update server. The malicious binary uses an invalid fake digital signature and replaces the legitimate eScan executable.
Page 1 of 3