A K
@sudojumble0 followers20 downloads64 copies3 likes677 views
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Categories
1
1
1
1
1
Platforms
3
1
1
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects behaviors associated with the GRIDTIDE backdoor, including a specific self-deletion technique using 'ping 127.0.0.1 && del' and the creation of unique mutexes. These indicators are highly specific to the GRIDTIDE threat.
Spot rogue or compromised endpoints attempting brute force attacks across your MDE fleet.
Author: Steven Lim
Author: Steven Lim
BRICKSTORM malware is a backdoor with multiple capabilities that theat actors use to set up persistence on exploited systems.