Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects abuse of package manager hooks for persistence, by hijacking the package manager execution flow
Detects scripts designed for container escape and host persistence
Detects usage udev rules launching at jobs or cron jobs for persistence
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
Detects WMI executing script engines as possible persistence mechanism
This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities.
Detects malicious udev rules for persistence
Detects VNC-based lateral movement activities. East to West traffic
This rule detects BITS job configuration files that exhibit characteristics of persistence mechanisms. It looks for the presence of BITS job structure elements, and sevral indicators suggesting abuse
Detects VNC-based activities. Looking for specific VNC processes
Page 31 of 38