Aamir Muhammad
@AamirTrusted contributorCompletionist
4 followers59 downloads1,103 copies30 likes30,775 views
52 detections
Filters
Last updated
All Time
Detection languages
27
25
Categories
22
21
19
17
16
Platforms
42
7
3
3
3
Products / Services
16
10
6
5
5
MITRE Techniques
30
26
25
22
11
CVEs
1
1
1
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack:
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
KQL Query
Kimsuky continues to evolve its espionage toolkit with stealthy, fileless techniques. Their latest JavaScript dropper, disguised as Themes.js, leverages LOLBins, C2 over legitimate domains, and scheduled task persistence — all while staying under the radar.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
This Logic detects the presence of the malicious Chrome extension FreeVPN.One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
A new RoKRAT variant tied to APT37 delivers payloads via oversized LNK shortcuts, executing a two‑stage encrypted shellcode loader that uses steganography to conceal content. The malware achieves fileless execution by injecting into trusted processes (e.g., mspaint.exe, notepad.exe) and hides C2 activity within legitimate cloud storage services such as pCloud, Yandex Disk, and Dropbox, often leveraging hardcoded API tokens.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
Page 5 of 6