nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects incoming emails from Atlassian Jira Cloud subdomains where the subject line matches known spam patterns used in a campaign abusing the service's reputation.
Detects execution of renamed instances of Microsoft Word from the Downloads directory, which may indicate masquerading or malicious delivery.
Detects suspicious creation of scheduled tasks via schtasks.exe using elevated accounts (Administrator, SYSTEM, NT AUTHORITY), excluding local host targets.
Detects file names associated with the Guloader Performance Report Pretext campaign.
Detects network connections or DNS queries to domains and IP addresses identified as payload delivery and C2 infrastructure for a JWrapper/SimpleHelp RAT campaign. Monitoring these indicators can help detect initial compromise or ongoing C2 communication.
Detects potential VELETRIX loader activity by identifying processes loading 'drstat.dll' from a path, where the loader executable is not 'drstat.exe'.
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
Detects XWorm V6 infection chain where wscript.exe spawns powershell.exe executing a .ps1 with Start-Process powershell
Detects file creation in Windows Startup folders which is a common persistence mechanism used by malware. Focuses on executable file types (.exe, .scr, .bat, .cmd, .vbs, .lnk)
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
Page 61 of 70