Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
No description available.
No description available.
Detects the creation of a scheduled task named 'WindowsUpdate' or 'BootUpdate' that triggers the execution of 'fsociety.exe' with SYSTEM privileges. This pattern is indicative of the TOKYOCORE malware establishing persistence on a Windows host.
No description available.
No description available.
Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.
No description available.
Detects creation of a mutex matching the 'NSMWClass_' naming pattern, a known fingerprint of NetSupport Manager/RAT observed during the Stereo campaign (e.g. Local\NSMWClass_141ea490473856ea).
Detects potential persistence attempts by monitoring suspicious modifications to Windows Winlogon registry keys, specifically targeting Shell, Userinit, GinaDLL, and Notify subkeys associated with the TOKYOCORE malware.
Detects the creation of a Windows service using 'sc.exe' with names or command-line indicators associated with legitimate Windows update services, a technique commonly used by the TOKYOCORE malware for persistence.
Page 12 of 23