Maggie Martin
@mmartin2 followers258 downloads50 copies10 likes1,024 views
10 detections
Filters
Last updated
All Time
Detection languages
6
1
1
1
1
Categories
4
2
1
1
1
Platforms
4
1
1
Products / Services
3
1
1
1
1
MITRE Techniques
3
2
2
2
2
Detects the execution of a Remote Desktop Protocol (.rdp) file from a temporary directory associated with Microsoft Outlook. This behavior is a key indicator of the initial access phase of the "Rogue RDP" campaign, where attackers deliver malicious .rdp files via email to compromise systems.
Detects command line patterns associated with the threat actor Bonadan (also known as APT27, Emissary Panda, Lucky Mouse, Bronze Union, G0065). This rule identifies the use of certutil for decoding payloads, wmic for process creation, and schtasks for persistence in suspicious directories.
Detects command line patterns associated with the threat actor Bonadan (also known as APT27, Emissary Panda, Lucky Mouse, Bronze Union, G0065). This rule identifies the use of certutil for decoding payloads, wmic for process creation, and schtasks for persistence in suspicious directories.
Detects suspicious child processes spawned by Citrix or Commvault services, which may indicate exploitation for initial access (T1190), as seen in MURKY PANDA campaigns involving CVE-2023-3519 and CVE-2025-3928.
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
Detects the execution of a Remote Desktop Protocol (.rdp) file from a temporary directory associated with Microsoft Outlook. This behavior is a key indicator of the initial access phase of the "Rogue RDP" campaign, where attackers deliver malicious .rdp files via email to compromise systems.
Detects suspicious child processes spawned by Citrix or Commvault services, which may indicate exploitation for initial access (T1190), as seen in MURKY PANDA campaigns involving CVE-2023-3519 and CVE-2025-3928.
Detects the s1ngularity malware attempting to add a shutdown command to shell configuration files (`.bashrc`, `.zshrc`) for persistence and system lockout.
Detects a specific, outdated Internet Explorer user-agent string used by the UpCrypter malware for C2 communications. This User-Agent string is highly specific and outdated, making legitimate use extremely unlikely in modern environments.
Detects a specific, outdated Internet Explorer user-agent string used by the UpCrypter malware for C2 communications.