Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers40 downloads219 copies24 likes1,172 views
65 detections
Filters
Last updated
All Time
Detection languages
38
20
4
2
1
Categories
18
12
10
10
8
Platforms
37
7
6
5
5
Products / Services
15
13
10
6
6
MITRE Techniques
18
17
16
13
9
CVEs
1
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
Detects a network connection to potentially malicious infrastructure or non-standard ports following a request to ipify.org, which is commonly used for external IP reconnaissance by malware and C2 frameworks.
Pycodevx Rat C2 Beacon
YARA-L
Detects outbound HTTP(S) requests carrying the 'pyCodeVx', 'pyCodeV3', 'pyCodeV4', or 'NEWW' string marker in the URI, User-Agent, headers, or body, indicating beaconing by the pyCodeVx Python-based RAT (and its variants) to its command-and-control infrastructure
Detects domain fronting abuse of Cloudflare CDN where the TLS SNI (outer front domain) differs from the inner HTTP Host header actually requested, a technique used to smuggle C2 traffic behind a trusted Cloudflare-fronted domain
Detects processes attempting to open a handle to the Local Security Authority Subsystem Service (LSASS) process with read-capable access rights (0x1010 or 0x1410). These access rights are commonly associated with credential dumping tools like Mimikatz, which read LSASS process memory to extract credentials. Legitimate system processes such as wininit.exe and services.exe are excluded to reduce noise.
Detects the execution of MEGAsync binaries (MEGAsync.exe, MEGAupdater.exe, or MEGAsyncSetup64.exe) from suspicious locations typically used for staging (Temp, Downloads, Public folders), or the creation of MEGAsync configuration and state cache files in the local AppData directory. This pattern is consistent with an adversary setting up a legitimate cloud storage client for data exfiltration.
Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.
Detects the temporary enablement of the UseLogonCredential registry value by setting it to 1, followed by a subsequent reversion to 0 on the same host. This pattern is indicative of a deliberate 'hit-and-run' attempt to force the WDigest security package to store plaintext credentials in memory for harvesting.
Detects the enabling of the WDigest UseLogonCredential registry value, which forces the storage of plaintext credentials in memory by the LSASS process, followed by a privileged interactive or remote interactive logon on the same host within 72 hours. This sequence suggests an attacker is positioning the system to harvest credentials.
Detects the creation of Windows Scheduled Tasks that reference MEGA sync client executables (MEGA, MEGAsync, MEGAupdater, MEGAcmd) from file paths outside of the expected Mega Limited installation directory. This can indicate an attempt to maintain persistence by masquerading as or hijacking a legitimate MEGA installation, even after the original application files are removed.
Page 1 of 7