Morgan Nwaiku
@sir_morganzeeCompletionist
0 followers10 downloads175 copies11 likes1,555 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
2
1
1
1
1
MITRE Techniques
2
1
1
1
1
CVEs
1
Attackers began actively exploiting CVE-2026-63030 and CVE-2026-60137 in WordPress Core in July 2026. The vulnerabilities involve the WordPress REST API batch-processing functionality and were used to deploy persistent web shells and malicious plugins. WordPress subsequently released fixes in versions 7.0.2, 6.9.5 and 6.8.6.
Detects suspicious scheduled task creation using schtasks.exe with XML task imports from user-writable directories such as AppData\Local. This behavior is associated with malware families like JustAskJacky, which establish persistence by creating GUID-named scheduled tasks that execute malicious payloads such as node.exe and obfuscated JavaScript files.
Detects potential APT10 (Stone Panda) activity by identifying the execution of known remote access tools (RATs) and suspicious use of utilities like WinRAR for password-protected archiving. The rule focuses on processes launched from non-standard directories and unusual parent processes, which may indicate malware execution, lateral movement, or data exfiltration.
This detection identifies instances where critical Windows kernel files (ntoskrnl.exe, ntoskml.exe, ntoskrnl64.exe) are executed or manipulated outside of standard system directories (e.g., C:\Windows\System32, C:\Windows\WinSxS). It focuses on processes exhibiting suspicious behaviours such as code injection, driver loading, hooking, or memory mapping/unmapping, while excluding benign system processes like services.exe, trustedinstaller.exe, and dism.exe. It also filters out temporary files created by common browsers (e.g., Chrome, Edge) to reduce false positives. This activity is indicative of potential malicious kernel-level manipulation, such as unauthorised drivers, rootkits, or other advanced persistent threats attempting to bypass security controls.
This detection identifies instances where Rundll32.exe or svchost.exe are executed by processes initiated through .lnk (shortcut) files, particularly those masquerading as PDFs or containing suspicious keywords like "申報物品清單" (Declaration of Items List). It further filters for command lines referencing potentially malicious file types such as .dll, .dat, .jpg, .zip, or .png, and checks for execution from common user or system directories often abused by malware (e.g., Temp, AppData, Public). This behavior is indicative of initial access or execution stages of malware campaigns, such as those involving the ToughProgress malware family.