Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects modifications to the Image File Execution Options (IFEO) registry keys for critical Windows accessibility binaries such as osk.exe, utilman.exe, sethc.exe, magnify.exe, and narrator.exe. This technique is commonly used by adversaries to establish persistence or facilitate unauthenticated privilege escalation by replacing these tools with malicious executables (e.g., cmd.exe) that execute when triggered from the Windows login screen.
Detects modifications to the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell' registry value. Attackers often modify this value to execute arbitrary malicious binaries or scripts upon user logon as a persistence mechanism, replacing the default 'explorer.exe'.
Detects the creation of local user accounts using the Windows net.exe utility, specifically looking for accounts containing the 'rage_master_' naming convention, often used by adversaries or automated tools for maintaining persistent access.
Detects the manual or malicious termination of security-related processes, including antivirus software, endpoint protection agents, and diagnostic/monitoring tools (e.g., Task Manager, Process Explorer, Wireshark). Such behavior is often indicative of an adversary attempting to impair security defenses to facilitate further malicious activity.
Detects the initialization of the PromptSpy malware's custom 'IpcSocket' class, which establishes a TCP listener bound to the localhost (127.0.0.1) address. This mechanism is utilized for inter-process communication between various components of the PromptSpy malware to coordinate malicious activities on the Android platform.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects the privilege escalation sequence used by VILE ransomware, which involves manipulating process tokens via a combination of OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, GetTokenInformation, SetTokenInformation, and DuplicateTokenEx. This is followed by the termination of processes using TerminateProcess, typically performed to release locked files before encryption.
Detects the execution of a VBScript file using wscript.exe, where the script is located in the user's Startup folder. This pattern is commonly used by malware to maintain persistence by ensuring the script executes automatically upon user logon.
Detects the modification of Windows Registry keys used to disable System Restore functionality, which can be an indication of an adversary attempting to inhibit system recovery.
Detects attempts to disable or tamper with Microsoft Defender by terminating its processes, stopping its associated services, adding directory exclusions, or modifying registry keys used to control its behavior and security settings.
Page 18 of 23