Chaitanya B B
@mralienCompletionist
10 followers825 downloads137 copies97 likes2,062 views
28 detections
Filters
Last updated
All Time
Detection languages
19
9
Categories
9
3
3
2
2
Platforms
12
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
13
13
10
7
7
KQL Query
Detects TTPs and IOC´s associated with a cryptomining campaign that exploits exposed Java Debug Wire Protocol (JDWP) services. Attackers gain remote code execution to download and execute a dropper script (`logservice.sh`), which in turn deploys a modified XMRig miner disguised as `logrotate`. The malware establishes persistence through multiple methods, including systemd services, cron jobs, and shell startup scripts.
KQL Query
KQL Query
KQL Query
KQL Query
Detects execution of regsvr32.exe with command line arguments indicating potential exploitation using remote scripts or controls.
Detects use of regsvr32.exe to load remote script/control objects from suspicious URLs, a technique used by APT28 and others.
Page 3 of 3