Robert Fly
@robertflyBay AreaCompletionist
0 followers424 downloads30 copies8 likes755 views
19 detections
Filters
Last updated
All Time
Detection languages
11
8
Categories
5
3
3
2
2
Platforms
9
4
2
1
1
Products / Services
3
1
1
1
1
MITRE Techniques
10
6
6
5
4
CVEs
3
3
2
Detects network connections to known command and control (C2) domains associated with the 'Banana Squad' threat actor using specific domain patterns and URL paths.
Detects network connections to known malicious domains and IPs associated with the Discord Invite Loop Hole campaign, including payload hosting, C2, and data exfiltration via Discord webhooks.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects the execution of a PowerShell command that downloads and executes a script from Pastebin, as seen in the Discord Invite Loop Hole campaign. This is the first stage after the user is tricked into pasting the command.
Detects the creation of the scheduled task named 'checker' which is used for persistence in the Discord Invite Loop Hole campaign, executing a VBScript every 5 minutes.
Detects the creation of a remote thread in sensitive processes indicative of code injection techniques, such as APC or thread injection.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects a process setting the RunOnce registry key and making suspicious network connections associated with DarkCloud Stealer.
Detects execution of executables disguised as media/archive files with deceptive filenames from download or app data directories, linked to the Fake Kling AI campaign.
Page 2 of 2