Chaitanya B B
@mralienCompletionist
10 followers825 downloads137 copies97 likes2,062 views
28 detections
Filters
Last updated
All Time
Detection languages
19
9
Categories
9
3
3
2
2
Platforms
12
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
13
13
10
7
7
Detects PowerShell activity associated with the Kimsuky threat actor, where system information is collected and exfiltrated to a private GitHub repository, or where other IOCs related to this campaign are observed. This technique was observed in a campaign distributing the XenoRAT malware.
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
Detects a wide range of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with SafePay ransomware, including specific command lines, persistence mechanisms, defense evasion techniques, and host-based artifacts.
Detects Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with a Havoc C2 variant. This includes specific file hashes, C2 network connections, and a unique command-line execution pattern involving a masqueraded conhost.exe creating a cmd.exe process for injection.
Detects Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with the Pay2Key ransomware campaign as reported by Morphisec in mid-2025. This includes specific file hashes, defense evasion techniques like adding Defender exclusions, sandbox evasion, and specific file artifacts.
Hypothesis: An adversary who has successfully phished a user for an OAuth authorization code or refresh token may use it in a non-interactive sign-in to abuse trusted first-party Microsoft applications for persistence or data exfiltration.
This rule detects two primary scenarios observed in such campaigns:
1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT).
2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
This rule detects two primary scenarios observed in such campaigns:
1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT).
2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
Detects the use of rundll32.exe to set WebDAV cookies, which can be indicative of forced authentication attempts or other malicious network activity. This technique is often used by adversaries to capture NTLM hashes by tricking a system into authenticating to a malicious server.
This rule detects file events where the target object path indicates a WebDAV mount point, specifically looking for paths containing '\Device\Mup\;WebDavRedirector\.*\DavWWWRoot\.*' combined with a domain name or IP address. This pattern is often associated with forced authentication attempts or ingress tool transfer via WebDAV.
Detects indicators of compromise (IOCs) associated with the Ducktail Infostealer malware. This malware often targets Facebook Business accounts and exfiltrates data such as browser cookies, cryptocurrency wallet information, and account details.
Detects host-based and network activity associated with the RondoDox botnet, including defense evasion, system sabotage, persistence, and known IOCs.
Page 2 of 3