nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects a Windows script host (wscript.exe or cscript.exe) spawning a Java process to execute a JAR file, a behavior observed in STRRAT malware delivery chains.
Detects the creation of a mutex with a pattern specific to the PKR_MTSI packer. This packer is often used to obfuscate malware.
Detects AI/ML model configuration files (e.g., config.json, model_config.yaml) containing a suspicious '_target_' value, which could indicate an attempt to exploit a Hydra instantiation vulnerability for remote code execution (RCE).
Dynamic Dns Lookup
YARA-L
Detects DNS queries to known Dynamic DNS (DDNS) providers. Attackers often leverage DDNS services for command and control (C2) infrastructure to evade IP-based blocklists by frequently changing the IP address associated with a domain.
Detects when the WinRAR process creates an executable or shortcut file in a user's Startup folder. This technique is used by adversaries, such as Paper Werewolf, to establish persistence.
Detects the IIS worker process (w3wp.exe) spawning suspicious child processes like command shells or reconnaissance tools. This is a common post-exploitation pattern observed after compromise of web applications, particularly Microsoft Exchange Server.
Detects network traffic consistent with XWorm malware using the Telegram API for Command and Control (C2) or data exfiltration. This rule specifically looks for HTTP requests to 'api.telegram.org' with URL patterns indicative of sending messages or files via the Telegram Bot API (e.g., /bot<token>/sendMessage, /bot<token>/sendDocument, /bot<token>/sendPhoto).
Summary
Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes.
What's New
A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against.
Actionable Threat Data
T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion.
T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.".
T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe.
T1055 - Process Injection: Identify instances of process hollowing
Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes.
What's New
A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against.
Actionable Threat Data
T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion.
T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.".
T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe.
T1055 - Process Injection: Identify instances of process hollowing
Detects attempts to perform prompt injection attacks against Large Language Models (LLMs) and AI bots. These attacks aim to subvert the model's original instructions, bypass safety mechanisms, or extract sensitive information.
Detects a single S3 object download event where the volume of data transferred exceeds a defined threshold. This can be an indicator of bulk data exfiltration. Attackers may download large archives or databases from compromised S3 buckets.
Page 69 of 70