Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects processes attempting to access specific files commonly associated with sandbox or virtual machine environments. This is a common evasion technique used by malware to detect analysis environments and terminate execution if detected.
Detects the creation of BMP files within the Temp directory containing the pattern 'wallpaper_', which is a behavior consistent with LIUSHEN ransomware modifying the desktop background to display a ransom note.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects the Snowlight dropper (UNC5221) installing a new Windows service named 'Windows Update Service' that utilizes a non-standard executable file named 'wusvc.exe' to achieve persistence and masquerade as the legitimate Windows Update service (wuauserv).
Detects the Snowlight dropper (wusvc.exe) attempting to open handles to known security analysis, debugging, and monitoring tools. This activity is a form of analyst environment detection used by the malware to identify if it is being executed within a research or sandbox environment before proceeding with further malicious actions.
Detects network communication with the Telegram API (api.telegram.org) originating from processes located in suspicious, user-writable directories such as Downloads, Temp, or AppData. This behavior is indicative of potential command and control (C2) communication or data exfiltration via the Telegram Bot API by malware.
Detects the creation of temporary files in the root directory (C:\) following the naming convention 'temp_*.tmp'. This pattern is associated with the evasion or decoy-generation behavior observed in Liushen ransomware, used to check for environmental artifacts or test file system operations.
Detects attempts by processes to gain raw read/write access to the physical disk (PhysicalDrive0), which is a common technique used by wiper malware to overwrite the Master Boot Record (MBR) and render the system unbootable.
Detects the creation of specific file artifacts associated with VILE ransomware in the Windows local temporary directory, indicating potential post-infection activity such as ransom note preparation or file staging.
Detects instances where the Windows Update Service (wusvc.exe) loads amsi.dll, a behavior associated with the Snowlight dropper to facilitate in-memory patching of AMSI functions (AmsiScanBuffer, AmsiInitialize, and AmsiOpenSession) and bypass security scanning.
Page 17 of 23