wakasa smoky
@wakasadb31 follower88 downloads24 copies1 like1,386 views
8 detections
Filters
Last updated
All Time
Detection languages
8
Categories
6
2
2
1
1
Platforms
7
Products / Services
1
1
MITRE Techniques
4
3
3
3
2
Detects the usage of the 'fsutil' command line tool to create a massively sized file explicitly named 'DiskFillerFile' to exhaust available disk space. This technique was observed in the Lotus Wiper destructive campaign to corrupt system operations and complicate recovery efforts.
Detects the execution of the Windows 'diskpart' utility combined with the 'clean all' command. This command forcefully overwrites all partition data with zeroes and is utilized by destructive threats, such as Lotus Wiper, to irrevocably destroy logical volumes.
Detects the specific usage of the 'net.exe' or 'net1.exe' command to lock out user accounts by setting them to inactive and restricting login times. This behavior was observed in the Lotus Wiper destructive campaign to prevent remediation before wiping the system.
Detects attempts to query, stop, or disable the legacy UI0Detect (Interactive Services Detection) service using the 'sc.exe' utility. This behavior was observed in the Lotus Wiper destructive campaign to suppress interactive service warnings before wiping the system.
This rule detects suspicious modifications to the KslD service registry keys, specifically targeting 'AllowedProcessName' or 'ImagePath' values. The detection logic looks for specific strings in the modified registry data that are indicative of KslKatz credential dumping activities, such as temporary driver paths, user profile paths, or temporary directory paths. This activity is often associated with enabling kernel read of LSASS memory for credential dumping.
Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.
Detects the creation or modification of .NET application configuration files (`.exe.config`) in sensitive framework directories. This is a technique known as AppDomain Hijacking, used by the Silver Dragon APT group to hijack legitimate Windows services like `dfsvc.exe` and `tzsync.exe` for persistence and to load their malware (MonikerLoader).
Detects the execution of sc.exe or reg.exe to create or modify specific Windows services to point to a malicious DLL. This technique is used by the Silver Dragon APT group to hijack legitimate services like 'bthsrv' and 'wuausrv' for persistence.