Marcus Mingo
@meeengoh2 followers276 downloads151 copies25 likes1,921 views
19 detections
Filters
Last updated
All Time
Detection languages
14
5
Categories
18
2
2
2
1
Platforms
19
1
1
Products / Services
11
6
4
3
1
MITRE Techniques
15
14
12
7
5
Detects msiexec.exe executing with /i to install an MSI package from a remote HTTP/HTTPS domain, excluding internal RFC1918 networks, loopback, and APIPA addresses. This pattern is commonly used for remote payload installation and malware staging over the web.
Detects PowerShell execution containing multiple repeated empty-string literal patterns such as "" or '' (including variants with whitespace), often used in trivial string-obfuscation techniques observed in malicious scripts. The regex is greedy so per environment tuning may be necessary.
Detects cmd.exe execution using /c or /k with input redirection ("<") from a file, which is commonly abused to execute staged payloads, scripts, or configuration files without directly invoking them.
Detects curl or wget execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors commonly use raw or hex IP literals to bypass domain-based filtering and download staged payloads.
Detects Windows Script Host (wscript.exe or cscript.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors frequently use raw or hex IP literals to bypass domain-based filtering and deliver payloads via script-based loaders.
Detects PowerShell command lines that reference HTTP/HTTPS content together with environment-backed AppData or Temp paths (e.g. %APPDATA%, $env:APPDATA, %TEMP%, $env:TEMP), a common pattern for downloading or staging payloads in user-writable directories.
Detects PowerShell command lines that use repeated, obfuscated string concatenation patterns such as "<str>"+"<str>" "<str>"+"<str>" (or the same with single quotes), which often appear in lightly obfuscated malware or LOLBins.
Often seen in dropper activity related to Clickfix.
Often seen in dropper activity related to Clickfix.
Detects PowerShell (powershell.exe or pwsh.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
Detects mshta execution where an HTTP/HTTPS URL targets a host expressed as a dot-quad IPv4 address or hex-encoded IPv4 address, excluding RFC1918 private address ranges. Threat actors frequently use raw or hex-encoded IP literals to evade domain filtering and deliver malicious HTA payloads.
Detects cmd.exe execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
Page 1 of 2