nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which may appear in process command lines when interacting with the database.
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
Detects the Microsoft Management Console (mmc.exe) spawning PowerShell with command-line arguments indicative of fileless execution, specifically using 'IEX' and 'DownloadString' or 'Net.WebClient' to retrieve and execute code from a remote location.
Detects MYRA RAT install-guard.js preinstall hook forcing re-execution with sudo npm install -g apintergrationpost to gain root privileges
Detects the use of net.exe or net1.exe to add a local user account to the 'Administrators' or 'Remote Desktop Users' groups. This is a common technique used by attackers to gain persistent, elevated access or enable remote access to a compromised machine.
Detects the use of common archive utilities (tar, zip, 7z) by the Bomgar remote support service process (bomgar-rep.exe or bomgar-scc.exe). This pattern is often associated with post-exploitation data staging where an attacker compresses internal files prior to exfiltration.
Detects sandbox evasion via sbiedll.dll presence check (T1497.001) followed by rapid process termination indicating the malware detected a sandbox and aborted execution, as observed in the FortiBleed steganographic loader campaign.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Page 32 of 70