Dasom Kim
@none0280 followers21 downloads26 copies0 likes481 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
2
1
1
1
1
Platforms
2
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
2
1
1
1
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This detection rule identifies hosts where data archiving using 7-Zip is closely followed by network traffic to the temp.sh file-sharing service. This correlation suggests a potential data staging and exfiltration sequence, a TTP observed in the Lynx Ransomware campaign.