nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the creation of specific directories (Bluetooth, ProShow, Adobe\Scripts) in the AppData folder by the Notepad++ updater (GUP.exe), a behavior associated with the Chrysalis backdoor persistence mechanism.
Detects the abuse of finger.exe as a download cradle, a technique used by the CrashFix campaign. This involves cmd.exe launching finger.exe (or a renamed copy) to retrieve a payload from a remote server and pipe it directly into cmd.exe for execution.
Detects a successful user login from a country that is on a restricted or high-risk list. This can indicate account compromise or policy violation.
Detects network traffic matching patterns associated with ModeloRAT C2 communication, such as connections to known C2 IPs or the use of a specific beaconing URI.
Detects persistence mechanism used by Valley RAT, associated with the Silver Fox APT. The malware stores its configuration or modular plugins as REG_BINARY data in the 'HKCU\Console' registry key.
Detects network connections to the typosquatted domain nexsnield.com, which is used by the malicious uBlock Origin Lite extension to track installations and correlate activity.
Detects process hollowing of tracerpt.exe, a technique used by the Valley RAT malware (associated with Silver Fox APT) to execute downloaded plugins. The rule identifies the creation of tracerpt.exe in a suspended state, followed by the creation of a remote thread within it, which is a strong indicator of code injection.
Detects potential exploitation of CVE-2026-25253, a 1-click RCE in OpenClaw, by identifying the 'gatewayUrl' query parameter in HTTP traffic. This parameter is used to hijack authentication tokens.
Detects network connections to known Command and Control (C2) infrastructure (domain or IP) associated with the Chrysalis backdoor, used in the Notepad++ supply chain attack.
This rule detects a highly suspicious activity where the Notepad++ updater process (GUP.exe) spawns the Windows Command Shell (cmd.exe) to execute various reconnaissance commands. This behavior is specifically linked to the Chrysalis backdoor, which was involved in a supply chain attack targeting Notepad++. The presence of commands like 'whoami', 'tasklist', 'systeminfo', 'ipconfig', and 'net' (with user, view, or group arguments) indicates an adversary attempting to gather information about the compromised system and network.
Page 65 of 70