Prashanth P
@prashanthblogs0 followers198 downloads10 copies2 likes275 views
6 detections
Filters
Last updated
All Time
Detection languages
5
1
Categories
2
1
1
1
1
Platforms
6
Products / Services
3
MITRE Techniques
2
1
1
1
1
A keylogger is an insidious form of spyware. when we enter sensitive data onto keyboard, believing nobody is watching. In fact, keylogging software is hard at work logging everything that you type. Keyloggers are activity-monitoring software programs that give hackers access to your personal data. The passwords and credit card numbers you type, the webpages you visit – all by logging your keyboard strokes. The software is installed on your computer, and records everything you type. Then it sends this log file to a server, where cybercriminals wait to make use of all this sensitive information.
Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
Detects and logs file creation events triggered by the FunkLocker ransomware executable across all monitored systems, enabling early identification of malicious activity and facilitating rapid incident response.
Detects when a process loads UIAutomationCore.dll, which may indicate abuse of Microsoft's UI Automation framework. This technique has been observed in Coyote malware for credential theft from banking applications and cryptocurrency exchanges. The rule monitors for processes that load the UI Automation Core library, which enables automated interaction with UI elements.
Detects the execution of a shell process (like cmd.exe or powershell.exe) spawned by the Microsoft HTML Application Host (mshta.exe). This behavior is often associated with malicious HTA files that use scripting objects like "WScript.Shell" to execute arbitrary commands, as seen in campaigns distributing Epsilon Red ransomware.
Detects creation of named pipes with UIA_PIPE_ prefix, which are used by Microsoft's UI Automation framework.
This activity may indicate malicious use of UI Automation for credential theft or unauthorized UI interaction.
Coyote malware has been observed using UI Automation to extract credentials from banking applications.
This activity may indicate malicious use of UI Automation for credential theft or unauthorized UI interaction.
Coyote malware has been observed using UI Automation to extract credentials from banking applications.