R W
@shiftyroot8 followers1,441 downloads177 copies78 likes4,581 views
60 detections
Filters
Last updated
All Time
Detection languages
31
13
5
4
3
Categories
18
14
10
8
8
Platforms
42
8
5
4
3
Products / Services
10
10
6
5
5
MITRE Techniques
27
18
18
17
10
This detection identifies network traffic to or from IP addresses known to be associated with command and control (C2) infrastructure or active exploitation in recent SharePoint vulnerability campaigns. Communication with these IPs is a strong indicator of either an attempted attack or an existing compromise.
This detection rule identifies the creation of ISO (.iso) files on endpoints, specifically focusing on those created by common internet browsers and email clients. This activity is associated with the SLOW#TEMPEST campaign, which is known to distribute malware payloads via ISO files, often bundled with legitimate applications and malicious DLLs. The rule aims to detect the initial delivery vector of this threat.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
Detects the creation of a randomly named executable (16-character alphanumeric) in common temporary directories (AppData\Local\Temp or C:\Windows\Temp). This behavior is associated with Warlock Dark Army ransomware.
This rule detects the execution of DLLs that exhibit signs of advanced code obfuscation, such as dynamic jumps (e.g., JMP RAX) or indirect function calls (e.g., CALL RAX). This technique is used by malware like SLOW#TEMPEST to hinder static and dynamic analysis. The rule specifically looks for indicators from an advanced EDR, sandbox, or memory analysis tool.
This detection identifies when the legitimate application DingTalk.exe loads a DLL from a non-standard file path. This behavior is associated with the SLOW#TEMPEST campaign, which uses this DLL sideloading technique to execute its malicious payload.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
This detection rule identifies the presence of the SLOW#TEMPEST ISO file based on its SHA256 hash. This ISO file is the initial delivery mechanism for the malware campaign.
SPL Query from file: NTDS.DIT Exfiltration Detection
SPL Query from file: Suspicious Scheduled Tasks Creation [lolbin]
Page 6 of 6