nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This is a persistence mechanism used by the CrashFix campaign to masquerade as a legitimate Windows service.
Detects the use of non-standard kill signals (-900, -901) used to manage the ShadowGuard eBPF rootkit's process allow-list. This activity is associated with the TGR-STA-1030 threat actor.
This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.
Detects the loading of 'log.dll' by 'BluetoothService.exe' or 'GUP.exe' from non-standard directories, a technique associated with the Chrysalis backdoor used in the Notepad++ supply chain attack.
Detects the VoidLink malware's initial dropper behavior, where a process masquerading as a kernel thread executes a payload from memory. This is indicative of the memfd_create and execveat fileless execution technique used by VoidLink, characterized by a process created with no FolderPath or FileName, initiated by a process named like a kernel thread.
Detects known malicious file hashes associated with the Clawdbot VS Code extension malware. This includes the weaponized ScreenConnect installer (Code.exe) and the Rust-based loader (DWrite.dll).
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
Detects the creation of a scheduled task named 'SoftwareProtection' used by the CrashFix campaign to execute a renamed Python interpreter for persistence.
Detects the abuse of the Windows 'finger.exe' utility to download and execute commands, a technique observed in the CrashFix campaign. The rule looks for finger.exe (or its renamed variant 'ct.exe') piping output to cmd.exe.
Detects the execution of an NSIS installer associated with the Silver Fox APT, which drops a legitimate executable (Thunder.exe) and a malicious DLL (libexpat.dll). This activity is the initial stage of the Silver Fox infection chain.
Page 63 of 70