nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects attempts to tamper with Windows Defender settings using PowerShell. This includes adding exclusions for paths/extensions or disabling real-time monitoring, which are techniques used by malware like the PHALT#BLYX campaign to evade detection.
Detects high-risk command execution (e.g., curl, wget, ssh) originating from AI agent runtime processes like OpenClaw/ClawdBot. This behavior is associated with threat actors using backdoored 'skills' to exfiltrate data or move laterally.
Detects the execution of Python scripts associated with the ModeloRAT, such as modes.py, extentions.py, or udp.pyw. This activity is part of the CrashFix campaign, where attackers deploy a portable Python environment to ensure payload execution.
Detects the execution of Python scripts with names associated with the ModeloRAT, often launched from user AppData or Temp directories as part of the CrashFix campaign.
Detects when a web browser process creates a high-risk file type (e.g., ISO, ZIP, EXE). This behavior is a strong indicator of HTML smuggling (T1027.006), where a malicious payload is decoded from an HTML file and written to disk by the browser itself to evade network security.
Detects the execution of wbadmin.exe with command line arguments used to back up or restore sensitive Active Directory database (NTDS.dit) or registry hives (SYSTEM). This is a common technique for credential dumping.
Detects successful anonymous user logins on Windows systems. This activity can be legitimate for accessing public resources but is also commonly used by attackers for enumeration and unauthorized access (e.g., ZeroLogon).
Detects processes other than known Microsoft identity components accessing sensitive authentication token directories (IdentityCache or OneAuth). Threat actors use this technique to steal session tokens to bypass MFA and maintain persistent access to cloud environments.
Detects network connections to or from a known malicious Command and Control (C2) IP address (91.92.242.30) associated with malicious OpenClaw/ClawdBot skills.
Detects the use of WMIC to add a file path to the Microsoft Defender exclusion list. This specific command structure is a known technique used by the MKDOOR backdoor to evade detection.
Page 64 of 70