nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the execution of known Windows privilege escalation tools commonly referred to as 'potato' exploits (e.g., JuicyPotato, SweetPotato, PrintSpoofer). These tools typically exploit service account misconfigurations or Windows APIs to achieve local privilege escalation to SYSTEM.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
Detects an executable containing numeric argument parsing and Base64 decoding routines used as a staged execution gate. This YARA rule specifically looks for the presence of API calls related to command-line argument parsing (CommandLineToArgvW, atoi, strtoul) and Base64 decoding (CryptStringToBinary) within an executable, which are indicative of malware like Sessiongate.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects Node.js processes initiating network connections to remote destination port 2222. This specific port and behavior pattern are known to be used by the Miasma botnet as a fallback C2 channel or for SSH-based remote access when standard communication ports are blocked or monitored.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
Detects the use of administrative utilities such as vssadmin.exe, wmic.exe, and wbadmin.exe to delete volume shadow copies or backup catalogs. This behavior is a common indicator of ransomware attempting to inhibit system recovery prior to encryption.
Detects the execution of python.exe from within the C:\Users\Public\ directory. Adversaries often drop portable Python environments in globally writable directories to execute malicious scripts or malware without requiring a formal installation on the host.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Page 16 of 70