Ramzi Zelfani
@rzelfani3 followers40 downloads181 copies14 likes2,598 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
3
3
2
2
2
Platforms
7
1
Products / Services
4
1
1
1
1
MITRE Techniques
5
3
3
2
2
CVEs
1
1
1
1
Detects the legitimate 'pdf24.exe' process loading 'cryptbase.dll'
from a non-standard directory. This is indicative of a DLL side-loading
attack, a technique used by the PDFSIDER malware to achieve execution and
bypass security controls.
from a non-standard directory. This is indicative of a DLL side-loading
attack, a technique used by the PDFSIDER malware to achieve execution and
bypass security controls.
Detects the use of curl.exe to download content from a remote source and pipe it directly into PowerShell for execution. This is a fileless execution technique used by adversaries like Storm-0249 to bypass traditional file-based defenses.
Detects when the legitimate SentinelAgentWorker.exe process loads 'SentinelAgentCore.dll' from a non-standard, user-writable directory like AppData\Roaming. This behavior is indicative of DLL sideloading (T1574.002), a technique used by threat actors like Storm-0249 to execute malicious code under a trusted process. The rule specifically checks for the SentinelOne agent process running from its expected installation path to increase fidelity.
Detects network traffic to Solana RPC endpoints containing the wallet address associated with the GlassWorm malware. GlassWorm uses the Solana blockchain as a resilient C2 mechanism by querying for transactions from an attacker-controlled wallet.
Detects a sequence of file operations indicative of CLFS Base Log File (.blf) tampering, a technique used in CVE-2024-49138 exploitation. The detection looks for a process writing to a .blf file, immediately followed by a read of the same file, which is an unusual pattern as regular applications use CLFS APIs, not direct file writes.
Detects potential exploitation of 7-Zip vulnerabilities CVE-2025-11001 and CVE-2025-11002. The exploit uses a malicious archive to create a symbolic link, which redirects a subsequent file write to an arbitrary, often sensitive, location on the filesystem. This detection looks for a 7-Zip process writing a potentially executable file to an unusual location such as the Desktop, Startup, or System folders.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
Detects the creation of a scheduled task that launches an executable from a non-standard, writable directory, which subsequently loads a co-located DLL. This pattern is a form of DLL Sideloading used for persistence and was observed in a ToddyCat APT attack.