Aamir Muhammad
@AamirTrusted contributorCompletionist
4 followers59 downloads1,103 copies30 likes30,775 views
52 detections
Filters
Last updated
All Time
Detection languages
27
25
Categories
22
21
19
17
16
Platforms
42
7
3
3
3
Products / Services
16
10
6
5
5
MITRE Techniques
30
26
25
22
11
CVEs
1
1
1
This rule detects activities associated with the BITTER threat group (TA397) campaign involving PapRAT and WmRAT implants. It correlates multiple data sources including process events, network connections, DNS queries, and file activities to identify specific indicators of compromise (IOCs), high-fidelity TTPs such as FTP script execution, obfuscated command lines, scheduled task persistence, C2 communications, and multi-stage chain correlation on Windows devices.
Detects indicators of compromise (IOCs) and suspicious behaviors associated with the BITTER threat group's PapRAT and WmRAT campaigns on Windows systems, including specific file hashes, malicious domains, C2 IP addresses, dropped files, scheduled tasks, and anomalous process execution chains.
Detects indicators of compromise (IOCs) and suspicious behaviors associated with the BITTER threat group's PapRAT and WmRAT campaigns on Windows systems, including specific file hashes, malicious domains, C2 IP addresses, dropped files, scheduled tasks, and anomalous process execution chains.
Detects phishing campaigns leveraging AWS Lambda Function URLs with pre-filled target email parameters used for credential harvesting. The rule correlates email delivery events, URL click events from email protection/safelinks, endpoint network connections to lambda URLs, and cloud app activity referencing these infrastructure endpoints.
This rule detects DNS requests to potential typosquatted, TLD-squatted, or combosquatted domains related to popular AI brands and services (such as Claude, ChatGPT, OpenAI, DeepSeek, and others) to identify potential typo-prompting and malicious redirection attempts.
Detects phishing campaigns leveraging AWS Lambda Function URLs with pre-filled target email parameters used for credential harvesting. The rule correlates email delivery events, URL click events from email protection/safelinks, endpoint network connections to lambda URLs, and cloud app activity referencing these infrastructure endpoints.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Page 1 of 6