Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to query system manufacturer or model information. This behavior is commonly employed by malware as an anti-virtualization or anti-sandbox technique to identify if it is running in a virtual machine environment by checking for known hypervisor-related strings in hardware identifiers.
Detects modifications to the Windows Registry where the 'EnableLUA' value is set to 0, which effectively disables User Account Control (UAC). This action is often performed by attackers to evade security prompts and maintain higher integrity levels during execution.
Detects attempts to inhibit system recovery by deleting Volume Shadow Copies using native Windows utilities (vssadmin, wmic, diskshadow) or modifying boot configuration to disable recovery settings (bcdedit), as well as unauthorized modifications to the FilesNotToSnapshot registry key.
Detects mass file renaming activities involving the '.Liushen' extension, commonly associated with the LIUSHEN ransomware behavior where files are appended with this extension after being encrypted.
Detects a specific anti-debugging technique used by LIUSHEN ransomware, where the malware executes a 1,000,000-iteration loop and measures the duration. If the loop takes longer than 0.5 seconds, it infers the presence of a debugger or analysis environment due to the induced latency.
Detects the Snowlight dropper (wusvc.exe) attempting to evade analysis by loading 'verifier.dll' to perform anti-debugging checks. This technique, associated with UNC5221 activity, involves inspecting the process environment and debugger-related messages to detect the presence of debugging tools.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Detects processes attempting to enumerate or interact with virtualization-related software such as VirtualBox, VMware, XenServer, or QEMU. This behavior is a common anti-analysis technique used by malware to detect if it is executing within a virtualized sandbox or hypervisor environment.
Detects the presence of the 'IsDebuggerPresent' string within command lines. This is a common Windows API call used by malware and potentially malicious scripts to detect if they are running under a debugger, allowing them to alter their behavior to avoid analysis.
Detects the sequence of API calls and process state changes indicative of process hollowing targeting a suspended svchost.exe process. The rule monitors for the creation of a suspended svchost.exe process followed by memory operations such as unmapping, allocating, and writing to the target process memory, culminating in thread context modification and resumption, a behavior consistent with malicious process injection techniques.
Page 16 of 23