nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the post-download execution stage of the abdrizak PostCSS typosquatting Windows RAT campaign. Covers three indicators: (1) wscript.exe executing a .vbs file from %TEMP% or subdirectory (e.g. update.vbs from winPatch), (2) chost.exe or any process launching loader.py as a command-line argument, (3) cmd.exe using tar to extract a .zip archive from %TEMP%.
Detects registry modifications to SyncRootManager occurring alongside cldflt.sys activity, which may indicate manipulation of cloud synchronization roots.
Detects the execution of known privilege escalation tools such as SweetPotato, JuicyPotato, RoguePotato, PrintSpoofer, and BadPotato. These tools are commonly used by attackers to escalate privileges on compromised Windows systems.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. This activity is associated with UNC6692 ("Snow Flurries") impersonating IT helpdesk over Teams, luring victims to a fake "Mailbox Repair Utility" page, and delivering a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Page 49 of 70