Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects Linux process creation where a shell script or command downloads a hidden binary named .b using wget or curl, changes its permissions to executable, and executes it in the background, matching behavior typical of the Mirai malware l.sh dropper.
Detects Linux process command lines associated with the Mirai l.sh dropper that establish persistence by appending a cron job running /var/.m to /var/spool/cron/root, or by copying and changing permissions of /var/.m within the MTD configuration partition (/mnt/mtd/Config/.m).
Detects Linux shell command lines that tie the /var/.m re-infection script to boot persistence by appending it to rc.local, rcS, or JAWS mtd startup scripts, or by copying it to /etc/init.d/bot and symlinking it as S99bot in runlevel directories.
Detects Linux process activity where the executable image is reported with a (deleted) tag, or where a hidden dropper binary (.b) is executed from a world-writable staging directory and removed. Mirai variants unlink their own binary after launch and keep running from the deleted file to hinder forensics.
Detects Linux process creation events associated with Mirai botnet dropper re-infection helper activity, such as fetching payloads into hidden directories (e.g., /tmp/.l) via curl or wget, executing hidden scripts, or modifying permissions on persistence helper files like /var/.m.
Detects a userland process whose image or command line is a bracketed kernel-thread name such as [kswapd0] or [kthreadd], which is a technique used by malware like Mirai to masquerade as legitimate kernel threads through prctl or argv manipulation.
Detects Linux file and process activity associated with Mirai botnet variants, specifically the creation of the hidden shared-memory file /dev/shm/.comm or processes that interact with hardware watchdog devices (/dev/watchdog, /dev/misc/watchdog) outside of known legitimate watchdog daemons.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Page 1 of 23