nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
Detects the execution of game_cache.exe, stats_db.exe, or save_data.exe from a randomly named subdirectory within specific AppData\Local folders (like SystemCache, WindowsCache, AppCache, etc.).
Detects frequent execution (3 or more within an hour) of .vbs or .vbe scripts via wscript.exe or cscript.exe where the command line contains keywords suggestive of lure documents such as invoices, payments, or reports. This behavior is commonly associated with malware droppers or phish-delivered scripts.
Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.
Page 48 of 70