Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
0 followers928 downloads90 copies1 like2,313 views
68 detections
Filters
Last updated
All Time
Detection languages
68
Categories
38
15
8
8
5
Platforms
59
5
1
1
1
Products / Services
23
15
6
2
2
MITRE Techniques
28
26
15
11
10
Detects a non-browser process creating a Chromium-style History database in a temporary directory, consistent with BraZetsu copying locked browser databases for reconnaissance.
This rule detects instances where wscript.exe spawns iexplore.exe. This behavior is highly suspicious because Microsoft Windows Script Host (wscript.exe) is typically used for running VBScript or JScript files, and it rarely requires launching Internet Explorer (iexplore.exe). Such execution chains are often used by malware or malicious scripts to bypass security controls or to execute code within the context of a browser process.
Detects SQL injection attempts on the WordPress REST API batch endpoint, specifically targeting the wp_users table to extract user credentials (user_pass and user_login), a technique used by attackers to compromise WordPress installations.
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects the creation of scheduled tasks using the 'schtasks.exe' utility, where the parent process is a Windows script host ('wscript.exe' or 'cscript.exe'). This is a common technique used by malware for persistence.
Detects the execution of Google Chrome or Microsoft Edge in headless mode by the Windows Installer service (msiexec.exe), utilizing remote debugging ports and custom user-data directories. This behavior is indicative of browser-hijacking techniques, such as those observed in msaRAT, used to establish covert C2 channels by manipulating the browser's CDP interface.
Detects the use of curl.exe to download a specific file named 'update_ms.msi' from a known malicious IP address. This behavior is indicative of a stager for msaRAT being downloaded onto a Windows host, potentially disguised to mimic a legitimate Windows update file.
Detects the loading of 'lib.dll' by the 'msiexec.exe' process. This behavior is atypical and may indicate DLL hijacking or sideloading where a malicious library is loaded by the Windows Installer process.
This rule detects rundll32.exe attempting to access the memory of common web browsers (Chrome, Edge, Firefox, IE). The activity is identified by the presence of 'jangadeiro' in the command line of the rundll32 process, which is a known behavior of the Lampion banking trojan used for browser overlay credential theft.
Page 1 of 7