Tun Tun Naing
@tuntunCompletionist
1 follower11 downloads270 copies3 likes7,894 views
19 detections
Filters
Last updated
All Time
Detection languages
19
Categories
5
1
1
1
Platforms
16
2
Products / Services
2
1
MITRE Techniques
3
3
3
1
1
CVEs
3
3
3
2
1
Detects new Microsoft Teams chats created by external unmanaged Microsoft accounts, identified by a .cid. prefixed UserId, targeting internal users. It is intended to identify possible impersonation, social engineering, or BEC-style activity.
Detects SYSTEM processes initiated by non-service user accounts from user-writable locations such as AppData, Temp, Public, ProgramData, and Downloads. This behavior may indicate local privilege escalation and is relevant to post-exploitation activity associated with CVE-2026-68820.
Detects FortiBleed related credential abuse activity against Fortinet SSL VPN by identifying high volume failed login attempts or password spraying from the same source IP. The rule also checks whether the same source IP later had a successful SSL VPN login
Detects suspicious child process execution or AD reconnaissance commands launched by DbgView64.exe, which may indicate Backdoor.Turn activity associated with DragonForce.
Detects public outbound network connections initiated by DbgView64.exe, DbgView.exe, or VirtualBox.exe. This activity may indicate DragonForce Backdoor.Turn behavior, where the malware abuses legitimate Microsoft Teams TURN relay infrastructure to hide command and control traffic.
Detects suspicious image loads from DbgView64.exe outside standard Windows directories and known vulnerable driver loads associated with DragonForce Backdoor.Turn activity.
Detects file and process activity related to the compromised Nx Console 18.95.0 VS Code extension, including known payload artifacts such as cat.py, kitty staging paths, LaunchAgent persistence, and daemonized execution indicators. This may indicate possible supply-chain compromise activity on a developer endpoint. Nx confirmed that version 18.95.0 was malicious and wrote artifacts such as ~/.local/share/kitty/cat.py, /tmp/kitty-*, /var/tmp/.gh_update_state, and macOS LaunchAgent persistence.
Detects command line activity where PowerShell, PowerShell Core, or CMD is used to download or extract suspicious payloads linked to the ModeloRAT campaign, including Dropbox hosted Winp.zip, WinPython, collector.py, and Pmanager.py.
Detects Python or Pythonw execution from the user AppData WinPython directory, including script names associated with ModeloRAT host reconnaissance and RAT execution activity.
Detects suspicious scheduled task creation, DLL execution, and campaign related artifacts such as TempLogA, ssss.dll, com6848.dll, collector.py, Pmanager.py, and WinPython execution paths that may indicate ModeloRAT persistence or post compromise activity.
Page 1 of 2