Marshall Yang
@marshopCompletionist
0 followers57 downloads17 copies1 like587 views
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Categories
1
1
1
1
1
Platforms
2
1
1
Products / Services
1
1
1
1
MITRE Techniques
2
2
1
1
1
Detects potential DLL side-loading activity associated with the MuddyWater threat actor. The rule identifies the legitimate Fortemedia application, FMAPP.exe, initiating network connections while running from a non-standard or suspicious directory, such as C:\Users\Public\Downloads\. This behavior is indicative of a malicious FMAPP.dll being loaded for command-and-control (C2) communications.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns 'node.exe' with command-line arguments containing '-e' and the process path is located within the 'AppData\Roaming' or 'AppData\Local' directories. This behavior can be indicative of malicious activity, such as the execution of Node.js-based scripts or malware by PowerShell, potentially for persistence or further execution within user-specific application data folders.
Detects large HTTP responses for URLs containing keywords associated with F5 BIG-IP configuration or archive files. This could indicate an attacker exfiltrating sensitive system configurations.
