Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects modifications to the Windows Registry 'Userinit' value under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'. Adversaries may modify this value to execute arbitrary malicious code automatically during user logon, establishing persistence.
Detects modifications to the Windows Registry key 'DisableTaskmgr' within the 'Policies\System' path, which is used to disable the Task Manager. This is a common tactic used by malicious actors to prevent users from monitoring or terminating malicious processes.
Detects processes attempting to enumerate or interact with specific Windows window classes (e.g., 'SysListView32', 'SHELLDLL_DefView', 'Progman') often used by malware like NoEscape ransomware to identify active desktop, taskbar, or explorer UI elements, likely to facilitate data theft or interface manipulation.
Detects the execution of the NoEscape ransomware DISKWRITER component by matching known file hashes associated with the wiper malware.
Detects modifications to Windows Registry keys associated with UI lockdown behaviors, specifically disabling Task Manager, altering User Account Control (UAC) settings, modifying auto-colorization, or resetting default UI tiles. These modifications are often used by malware or malicious actors to inhibit user interaction, bypass security prompts, or persist UI-level restrictions.
Detects the use of 'regedit.exe' with the '/s' flag to perform a silent import of a registry file. This behavior is often used by adversaries to modify system configurations, establish persistence, or perform other registry-based attacks without user interaction. This specific rule includes a check for a hardcoded path 'C:\Windows\System32\hello.reg', suggesting targeted activity.
Detects the execution of the Windows shutdown utility with arguments to force an immediate system reboot. This behavior is commonly observed during the final stages of ransomware attacks, such as NoEscape, to force the system into a state where encrypted files are finalized or to disrupt user access.
Detects the use of WMIC to rename a local administrator account to 'NO ESCAPE'. This behavior is associated with the NoEscape ransomware, which renames the built-in administrator account to 'NO ESCAPE' as part of its post-compromise activity.
Detects the creation of specific image files (e.g., .png, .bmp) at the root of the system drive (C:\). This behavior is associated with certain ransomware strains (such as NoEscape) that stage files with misleading extensions in unusual locations to evade detection.
Detects direct raw access to the primary physical disk device (PhysicalDrive0) on Windows systems. This behavior is often associated with ransomware or wiper malware attempting to overwrite the Master Boot Record (MBR) or partition table to render the system unbootable.
Page 15 of 23