Mitchell V
@mvani0 followers9 downloads29 copies1 like444 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
1
Detects the execution of remote access, tunneling, and credential access tools from suspicious directories. This rule specifically targets tools commonly abused by threat actors like Scattered Spider, such as AnyDesk, TeamViewer, ngrok, Teleport, Tailscale, and Mimikatz, when executed from user-writable or temporary folders. It excludes legitimate installations in standard Program Files directories to reduce false positives.
Detects the creation of files and services associated with malicious drivers (hlpdrv.sys, rwdrv.sys) used by Akira ransomware affiliates for defense evasion, as reported by GuidePoint Security. This rule specifically looks for the creation of these driver files and the associated service registrations in the Windows Registry.