Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,383 copies51 likes26,140 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects Sauron Loader stage-2 payload execution: a randomly-named file dropped in %TEMP% and executed within 5 minutes by a native launcher (rundll32/regsvr32/msiexec/cmd/powershell/wscript). Scoped to devices that already show the confirmed rnpkeys.exe side-load from ProgramData\keyroll, turning a very noisy fleet-wide 'temp file executed by native binary' heuristic (matches countless legitimate installers/updaters) into a targeted next-stage check on hosts with corroborated Sauron Loader activity. Also fixes an unused/dead variable and an ambiguous post-join column reference.
Detects Sauron Loader stage-2 payload execution: a randomly-named file dropped in %TEMP% and executed within 5 minutes by a native launcher (rundll32/regsvr32/msiexec/cmd/powershell/wscript). Scoped to devices that already show the confirmed rnpkeys.exe side-load from ProgramData\keyroll, turning a very noisy fleet-wide 'temp file executed by native binary' heuristic (matches countless legitimate installers/updaters) into a targeted next-stage check on hosts with corroborated Sauron Loader activity. Also fixes an unused/dead variable and an ambiguous post-join column reference.
Detects the Sauron Loader DLL side-loading chain: rnpkeys.exe (legitimate) side-loading malicious rnp.dll, which loads tdwp.dll to decrypt the loader in memory, all staged from C:\ProgramData\keyroll. Requires BOTH DLLs to be loaded by the same rnpkeys.exe process instance (not either/or) to eliminate single-artifact false positives, and surfaces SHA256 hashes of all three components for direct comparison against known IOCs (legitimate rnpkeys.exe: 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991; malicious rnp.dll: 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8; malicious tdwp.dll: 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7).
Detects the Sauron Loader DLL side-loading chain: rnpkeys.exe (legitimate) side-loading malicious rnp.dll, which loads tdwp.dll to decrypt the loader in memory, all staged from C:\ProgramData\keyroll. Requires BOTH DLLs to be loaded by the same rnpkeys.exe process instance (not either/or) to eliminate single-artifact false positives, and surfaces SHA256 hashes of all three components for direct comparison against known IOCs (legitimate rnpkeys.exe: 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991; malicious rnp.dll: 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8; malicious tdwp.dll: 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7).
Detects the Sauron Loader DLL side-loading chain: rnpkeys.exe (legitimate) side-loading malicious rnp.dll, which loads tdwp.dll to decrypt the loader in memory, all staged from C:\ProgramData\keyroll. Requires BOTH DLLs to be loaded by the same rnpkeys.exe process instance (not either/or) to eliminate single-artifact false positives, and surfaces SHA256 hashes of all three components for direct comparison against known IOCs (legitimate rnpkeys.exe: 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991; malicious rnp.dll: 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8; malicious tdwp.dll: 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7).
Detects the Sauron Loader DLL side-loading chain: rnpkeys.exe (legitimate) side-loading malicious rnp.dll, which loads tdwp.dll to decrypt the loader in memory, all staged from C:\ProgramData\keyroll. Requires BOTH DLLs to be loaded by the same rnpkeys.exe process instance (not either/or) to eliminate single-artifact false positives, and surfaces SHA256 hashes of all three components for direct comparison against known IOCs (legitimate rnpkeys.exe: 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991; malicious rnp.dll: 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8; malicious tdwp.dll: 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7).
Detects creation of the 'keyroll' scheduled task used to relaunch the Sauron Loader DLL side-loading chain. Requires the schtasks.exe command line to both reference the 'keyroll' task name AND explicitly reference the ProgramData\keyroll path or rnpkeys.exe (ruling out unrelated tasks that happen to be named 'keyroll', e.g. legitimate key-rotation automation), and requires an INNER join corroborating an actual rnpkeys.exe relaunch from that path within 24h — a lone task-creation event with no follow-on relaunch no longer alerts.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Page 217 of 756