Matt Brady
@mbrady52996 followers1,729 downloads124 copies95 likes3,796 views
62 detections
Filters
Last updated
All Time
Detection languages
37
25
Categories
20
14
7
7
5
Platforms
20
9
8
6
4
Products / Services
7
3
3
2
2
MITRE Techniques
23
22
19
14
13
IDS Classtypes
1
IDS Protocols
1
Detects Microsoft 365 access attempts where the ClientAppId masquerades as Microsoft Office (d3590ed6-52b3-4102-aeff-aad2292ab01c) to bypass conditional access policies, but the UserAgent string reveals the use of a programmatic script (e.g., Python, PowerShell). This mismatch is a known tactic utilized by UNC6671 (BlackFile) during automated data exfiltration operations.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
Detects programmatic file access in Microsoft 365/SharePoint environments where the operation is logged as 'FileAccessed' but the UserAgent indicates a scripting library like python-requests or PowerShell. This behavior is indicative of data exfiltration techniques used by actors like UNC6671 (BlackFile) who stream file content directly to bypass traditional 'FileDownloaded' monitoring.
Detects the Golang Sliver dropper or its associated opsec.log file. This malware leverages an LLM (GPT-4) to evaluate system telemetry before deploying its payload.
Detects log files or unpacked binaries associated with the .NET infostealer 'AI Theater' that uses ChatGPT for illusory evasion techniques. Identifies specific log markers such as LLM verification and evasion generation.
Detects .NET infostealer ('AI Theater') binaries containing specific custom HTTP headers (X-LLM-Enhanced, X-Message) and hardcoded C2 infrastructure used for exfiltration.
Detects the execution of the command to stop the vCenter remote management service (vpxa) on an ESXi host. This is a technique used by the RansomHouse MrAgent tool to inhibit system recovery and impair defenses before deploying the Mario encryptor.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
Detects the execution of the ESXi command 'esxcli network firewall set --enabled false' used by the RansomHouse MrAgent deployment tool to disable the host's firewall. This is a defense evasion technique used to ensure C2 communication and subsequent ransomware deployment.
Detects the renaming of critical virtualization files by the RansomHouse 'Mario' encryptor, which appends an extension containing '.mario' (e.g., '.emario'). This activity is a strong indicator of a successful encryption event on an ESXi host.
Page 1 of 7