Zy Dnz
@zydnz0 followers101 downloads13 copies2 likes569 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
3
2
1
1
1
Platforms
4
1
Products / Services
1
1
1
1
1
MITRE Techniques
5
2
1
1
1
Detects potential command injection attempts in the body of HTTP POST requests. Attackers, such as those operating the RondoDoX botnet, exploit unsanitized input fields in web interfaces of SOHO routers, IoT devices, and other applications to execute arbitrary commands. This rule looks for common command-line tools and shell characters within the POST body, particularly in requests targeting parameters known to be vulnerable.
This rule aimed to detect NetSupport RAT via MSIX app installer files. Attackers use csvde.exe to collect target device informations such as ip and accountname. They put outputs to the file (-f). And then send it to the attacker.
The threat actor created an account using the net user command. When a $ is added to the end of the account name during account creation, the account is created with a hidden attribute. In this case, the account cannot be identified using the (net user command), and can only be identified in the SAM registry. In a RID Hijacking attack, threat actors modify the RID value of an account in the SAM registry so that the Windows operating system recognizes it as a changed RID. In the Windows operating system, the registry key related to user accounts are stored in the path HKEY_LOCAL_MACHINE\ SAM\SAM\Domains\Account\Users. The RID of a user account is written in the little-endian format as 4 bytes in the 0x30 0x33 area of the F value under each account key. Threat actors change the value at this offset to the RID of the hijacking target.
Detects CVE-2024-2389 detected on April 23 on Progress Flowmon. This rule detecting access to the vulnerable function parameters in specific endpoin (/service.pdfs/confluence). Attacker can be use vulnerable file and pluginPath variables directly requesting them. Howewer, to able to use those two variables lang must set to any value.
Detects process creations where parent is cmd.exe or PowerShell.exe and the command line contains . swp, webserver/temp/webserver, -Noninteractive and -EncodedCommand.
Detects the creation of a scheduled task named "MicrosoftsUpdate" which is used to execute a malicious batch file as part of the HrServ web shell infection chain.