Shikha Sangwan
@ssangwan1 follower70 downloads33 copies2 likes1,219 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
4
3
3
2
1
Platforms
6
2
1
Products / Services
1
MITRE Techniques
3
2
1
1
1
Detects the execution of an 'update.exe' process spawned by 'svchost.exe'. This specific process chain is validated by the second-stage loader of the MiniFast backdoor (associated with Nimbus Manticore) as an anti-analysis mechanism to ensure the execution originates from its scheduled-task persistence rather than a sandbox or direct execution.
Detects native Windows scripting hosts (wscript.exe, cscript.exe) establishing outbound network connections over SMTPS (port 465). This is highly anomalous and was observed in the FAUX#ELEVATE campaign where threat actors exfiltrated stolen credentials and browser data using Collaboration Data Objects (CDO) via VBScript to external SMTP servers.
Detects the execution of VBScript files via wscript.exe or cscript.exe originating from the C:\Users\Public\ directory. This behavior is highly suspicious and indicative of malware staging, as observed in the FAUX#ELEVATE campaign.
Detects a high volume of network connections from a browser process to a high port on the local host (127.0.0.1 or ::1). This pattern can indicate a malicious website attempting to brute-force credentials for a local service, such as the OpenClaw AI agent, by abusing the browser's permission to establish WebSocket connections to localhost. The vulnerable service may not rate-limit these local connections, allowing for rapid password guessing.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects Microsoft Office applications such as Word or Excel spawning a command-line interpreter (cmd.exe or powershell.exe). This behavior is often associated with malicious documents that execute macros to run commands on the victim's system. The MuddyWater group has been observed using this technique in their 'Operation Olalampo' campaign.