Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
No description available.
Detects the execution of a specific batch script named 'C:\hello.bat' using the Windows Command Shell (cmd.exe). The presence of this specific script name is considered highly anomalous and potentially indicative of malicious activity or a dropped payload.
Detects the disabling of User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. Adversaries may disable UAC to bypass elevation prompts and facilitate unauthorized modifications to the operating system.
Detects modifications to Windows Registry keys associated with executable file handling (exefile\shell\open\command, etc.) that set the handler to 'winnt32.exe'. This technique is used by the NoEscape ransomware to hijack the execution of legitimate programs and force the execution of its own malicious binary whenever an executable is run, ensuring persistence and impact.
Detects modifications to the Windows Registry that disable the ability for a user to change their desktop wallpaper by setting the 'NoChangingWallPaper' value within the 'ActiveDesktop' policy key to '1'. This is often associated with system tampering to enforce restricted user environments.
Detects specific registry modifications indicative of the NoEscape ransomware, including changes to desktop wallpaper settings, auto-colorization preferences, and Explorer shell policies used to restrict user interaction or modify system aesthetics as part of an extortion campaign.
This rule detects execution chains associated with the Quima RAT loader, specifically monitoring for VBScript-based child processes spawning suspicious command-line activity. This includes the use of certutil.exe to decode payloads, discovery commands like 'where javaw', and the execution of suspicious Java processes with specific arguments or paths indicative of malicious behavior.
Detects the execution of processes containing command line strings associated with the NoEscape ransomware lock screen. These messages are used to intimidate victims by displaying full-screen ransom demands.
Detects the creation of a 'C:\user.png' file, which is known to be used as a marker file by NoEscape ransomware/wiper malware at the root of the system drive.
Detects the use of the Windows 'takeown.exe' utility to recursively change the ownership of the 'Microsoft\User Account Pictures' directory. This specific behavior is associated with the NoEscape ransomware, which modifies permissions on system folders to facilitate file encryption or impede recovery operations.
Page 14 of 23