Yolanda Icepa
@yicepa2 followers306 downloads19 copies12 likes800 views
11 detections
Filters
Last updated
All Time
Detection languages
10
1
Categories
4
3
2
2
2
Platforms
7
4
Products / Services
3
2
1
1
1
MITRE Techniques
6
4
4
4
3
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
Detects the execution of a packet capture command with a specific buffer size known to be used by the LINE VIPER malware on Cisco ASA devices. LINE VIPER is a sophisticated malware designed to target Cisco ASA devices, often deployed by the RayInitiator bootkit.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Detects the execution of suspicious commands commonly used for reconnaissance or networking, where the parent process command indicates it was triggered by an npm 'postinstall' script. This behavior is associated with the XORIndex loader used in the "Contagious Interview" campaign.
Detects the creation of "spinstall0.aspx", a file dropped after the successful exploitation of the SharePoint vulnerability CVE-2025-53770. This file is a known webshell.
Detects PowerShell commands using string reversal techniques and specific numeric padding, methods observed in Kimsuky's "ClickFix" campaigns to obfuscate malicious code. The rule looks for a combination of PowerShell string manipulation functions and a unique numeric string.
Detects HTTP POST requests containing suspicious parameters or headers used by GoldMelody's in-memory IIS modules. Attackers leverage ASP.NET ViewState deserialization to execute payloads in memory, often passing commands and data via non-standard HTTP parameters and headers within POST requests.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
Page 1 of 2