michael lohn
@mlohn1984Completionist
1 follower4 downloads220 copies4 likes4,579 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
2
2
2
1
1
Platforms
5
2
1
1
Products / Services
2
2
1
MITRE Techniques
3
3
2
2
2
CVEs
1
1
1
1
1
IDS Classtypes
2
1
1
UD Crypt (fudcrypt.net) is a Malware-as-a-Service crypter platform ($800–$2,000/month) that produces polymorphic Windows loaders carrying valid Microsoft-chained Authenticode signatures via Azure Trusted Signing abuse. The signature chains to the "Microsoft Identity Verification Root CA", bypassing SmartScreen and EV-signing checks. The loader abuses DLL sideloading into legitimate signed binaries (Zoom, Slack, VS Code, OneDrive, CCleaner, ProtonVPN, WindowsDF.exe → mpclient.dll), patches AMSI and ETW in-memory, masquerades the PEB as explorer.exe, and beacons via WSS to mstelemetrycloud.com. In a 38-day observation window: 200 operators, 334 builds, 2,093 C2 commands, 32 confirmed victims.
Detects the full infection chain of a trojanized Proxifier installer hosted on GitHub (lukecodix/Proxifier releases) distributing ClipBanker RAT. Active since early 2025 with 2,000+ confirmed victims (India/Vietnam focus). The malicious wrapper adds Defender exclusions for TMP/powershell/conhost, creates a ~1.5KB stub (Proxifier*.tmp) as a donor process, injects api_updater.exe and proxifierupdater.exe, then hollows into conhost.exe and fontdrvhost.exe to deliver a fileless C++ ClipBanker payload that replaces crypto wallet addresses across 26+ blockchains (BTC, ETH, SOL, XRP, DOGE, LTC, XMR, ADA, BNB, etc.). Multi-stage payload retrieved from pastebin, snippet.host, chiaselinks.com, rlim.com, paste.kealper.com, and secondary GitHub/Gitea repos. Persistence via HKLM\SOFTWARE\System::Config (Base64 PowerShell) + scheduled task. 12 queries covering known hashes, trojanized binary names, Defender exclusion abuse, registry persistence, schtask-to-PowerShell-to-registry chain, process hollowing into OS binaries, C2/payload domains, Pastebin/Gist exact-path IOC hits, fontdrvhost/conhost outbound anomaly, Proxifier*.tmp stub detection, GitHub-release-to-execution correlation, and full kill-chain correlation.
Detects the full kill-chain used by modern ransomware operators (RansomHub, LockBit affiliates, BlackCat/ALPHV, FIN7) who deploy EDR killers (EDRKillShifter, AvNeutralizer/AuKill, Terminator, RealBlindingEDR, GhostDriver/Poortry, Backstab) in the pre-encryption phase. These tools use the BYOVD (Bring Your Own Vulnerable Driver) technique — loading a legitimately-signed but vulnerable kernel driver (rtcore64.sys, gdrv.sys, truesight.sys, dbutil_2_3.sys, mhyprot2.sys, procexp152.sys, aswarpot.sys, zam64.sys) as a kernel service, then abusing its IOCTLs to terminate protected EDR processes from kernel space, bypassing PPL. This pack contains 10 queries covering vulnerable driver loads, drivers dropped to user-writable paths, kernel service creation, known EDR-killer binaries, Defender/EDR service tampering, mass security-process termination bursts, unsigned kernel loads, registry-based Defender tampering, full driver→service→kill chain correlation within 1h, and a hash-free behavioural catch-all (unsigned loader → sc.exe create kernel service within 60s).
Multi-layered detection for two linked March 2026 threat campaigns identified by ANY.RUN and Objective-See:
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
This detection identifies the presence of ChipSoft HiX electronic health record (EHR) software within the environment. ChipSoft is the dominant EHR provider in the Netherlands (~70% market share in Dutch healthcare). On April 7, 2026, ChipSoft was hit by a ransomware attack affecting HiX on-premise, HiX SaaS, and the SaaS patient portal. Z-CERT (Dutch healthcare CERT) advised all customers to immediately disconnect VPN connections to ChipSoft and intensively monitor network traffic.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Detects successful POST requests to better-auth API key creation or update endpoints that appear to be unauthenticated. This pattern is indicative of exploitation of CVE-2025-61928, where an attacker can create or modify API keys for any user without a valid session.
This rule detects network connections to domains and IP addresses associated with the malicious OpenClawCLI campaign, which uses social engineering to trick users into running obfuscated commands.
Detects when a Network Attached Storage (NAS) or Internet of Things (IoT) device establishes multiple or high-volume outbound SSH/SFTP connections to an external IP address. This behavior can indicate that the device has been compromised and is being used as an 'Operational Relay Box' (ORB) to proxy malicious traffic, mask C2 communications, or exfiltrate data.