S@1@N .
@kohtetCompletionist
1 follower441 downloads47 copies9 likes22,673 views
21 detections
Filters
Last updated
All Time
Detection languages
21
Categories
11
4
3
1
1
Platforms
20
MITRE Techniques
14
10
6
5
4
Detects modification of the Windows hosts file to redirect eScan antivirus update servers (e.g., update1.mwti.net) to the non-routable IP address 2.3.4.0. This behavior prevents antivirus updates and is indicative of defense evasion or supply-chain related tampering.
Detects modification of the eScan for Windows MwMonitor registry key to add critical system directories (C:\Windows, C:\Program Files, C:\Program Files (x86)) to antivirus exceptions. This behavior significantly weakens endpoint protection and may indicate malicious tampering or supply-chain abuse.
Detects storage of a PowerShell-based persistent payload in the Windows registry under a non-standard GUID-based key using the Corel value. This technique is used by the final stage of the eScan supply-chain attack to establish stealthy persistence after environment validation.
Detects when Visual Studio Code or its extension host spawns PowerShell, CMD, or similar interpreters (possible SleepyDuck payload execution).
Detects exploitation attempts of CVE-2025-0108 via crafted path traversal requests targeting PAN-OS web management interface.
Detects possible abuse of Notepad++ installer (v8.8.1) where a malicious regsvr32.exe is executed from an untrusted directory, leading to privilege escalation to SYSTEM.
Detects execution of mshta.exe from PowerShell, often used for malware delivery via malicious URLs.
Detects execution of mshta.exe from explorer.exe with an inline HTA script that reads and executes code from the registry.
Detects suspicious execution of mshta.exe from cmd.exe with embedded JavaScript and registry modifications.
Detects execution of mshta.exe with inline scripting using protocol handlers (vbscript, javascript, about)
Page 2 of 3