nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
Detects PowerShell one-liners using Invoke-RestMethod (irm) or Invoke-WebRequest (iwr) piped to Invoke-Expression (iex) to download and execute the TrustConnect or DocConnect RAT.
Detects outbound network connections to known Command and Control (C2) domains and IPs associated with the TrustConnect and DocConnect malware infrastructure.
Detects creation of the LunarApplication directory used by an infostealer to stage credential and cryptocurrency theft.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Detects PowerShell downloading XWorm V6 binary from github.com, spawned by wscript.exe
Detects suspicious modification of the Windows TIP AggregateResults registry key with large data indicative of persistence.
Detects the creation of JSP web shells or suspicious CSS files in the specific directory used by Ivanti EPMM for application distribution, a common post-exploitation step observed in this campaign.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
Detects processes masquerading as legitimate software making HTTP requests to specific API endpoints associated with the TrustConnect/DocConnect RAT C2.
Page 59 of 70