Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects the creation or modification of WMI event subscriptions using the wmic.exe command-line utility. Adversaries utilize WMI event subscriptions for persistence by configuring event filters, consumers, and bindings that execute malicious code upon specific system events.
No description available.
Detects the use of bcdedit.exe to modify boot configuration data in a way that disables system recovery features, ignores boot failures, or bypasses integrity checks. This activity is often associated with ransomware or malicious persistence mechanisms aimed at preventing system recovery or loading unsigned drivers.
Detects potential lateral movement by identifying the creation or modification of a file named 'fsociety.exe' on sensitive Windows administrative shares (ADMIN$ or C$). This behavior is consistent with the TOKYOCORE worm-like threat activity, where malicious binaries are replicated across the network.
Detects the creation or modification of Windows Registry Run keys that masquerade as the legitimate 'WindowsUpdate' process. The rule identifies suspicious autorun entries, such as 'fsociety.exe' or specific file hashes, being registered under common Run or RunOnce keys to maintain persistence.
Detects unauthorized modification of the BootExecute Registry key to execute a file named 'bootexec.bat'. The BootExecute key, located in 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', is processed by the Windows Session Manager during early system boot. Adversaries can leverage this to maintain persistence or execute malicious code before most security products initialize.
Detects direct raw disk access to \\.\PhysicalDrive0 consistent with TOKYOCORE's wiper mode overwriting the Master Boot Record (sector 0) to render the system unbootable.
Detects unauthorized write or modification access to core Windows boot-related files such as bootmgr, winload.efi, and the BCD store. This activity is indicative of destructive wiper malware attempting to render the operating system unbootable to prevent recovery, a technique observed in the TOKYOCORE wiper campaign.
Detects the use of the 'net.exe' command to reset the password of a local administrator account. This behavior is specifically associated with the NoEscape ransomware, which utilizes this command as part of its impact-oriented activity to prevent authorized access to the compromised system.
Detects the dropping of the NoEscape ransomware DISKWRITER binary, masquerading as 'winnt32.exe' within the C:\Windows\SysWOW64\ directory. This is identified by the specific file path and hash associated with the known malware threat.
Page 13 of 23