Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,384 copies51 likes26,173 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Page 516 of 756