Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects unauthorized processes attempting to access Firefox credential storage files (key4.db, logins.json) or loading the NSS cryptographic library (nss3.dll) commonly used by Firefox for decryption, which is indicative of credential harvesting.
Detects the use of WMI queries targeting the Win32_AntivirusProduct class or the root\SecurityCenter2 namespace to enumerate installed antivirus products on a Windows host. This technique is commonly used by adversaries for discovery during the reconnaissance phase to identify security controls before proceeding with further malicious actions.
Detects TrymeLocker modifying the Image File Execution Options (IFEO) for accessibility binaries to establish a login screen backdoor with SYSTEM privileges.
Detects the use of bcdedit.exe to disable automatic Windows recovery or suppress boot failure notifications. Adversaries often perform this action during the impact phase of an attack to prevent system restoration after data destruction or ransomware encryption.
This rule detects the creation or modification of the 'NoRun' registry value under the Explorer policies key. This policy is used to remove the 'Run' command from the Start Menu, effectively preventing users from launching applications via the standard Run dialog. Adversaries may use this to impair user interaction or as part of a broader defense evasion effort to restrict access to system utilities.
Detects the creation of a Windows Registry Run key containing a misspelling of 'Microsoft Corporation' (as 'Microsoft Coporation') which is configured to launch 'fixmapi.exe'. This pattern is indicative of a persistence mechanism masquerading as a legitimate Microsoft process.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
Detects unauthorized processes attempting to access Discord's local LevelDB storage files, which are commonly targeted by info-stealing malware to extract sensitive session tokens and user data.
Detects registry access attempts to the CLSID registration entries for Chrome, Brave, and Edge IElevator COM interfaces. These interfaces are designed for browser-internal maintenance tasks. Adversaries, such as the operators of WEES Stealer, abuse these interfaces by invoking the IElevator DecryptData method via out-of-process COM activation to decrypt App-Bound encryption keys, bypassing standard browser security boundaries.
Detects a process attempting to read its own Process Environment Block (PEB) using NtQueryInformationProcess in combination with ReadProcessMemory, a technique commonly used by malware to detect the presence of a debugger by inspecting the NtGlobalFlag field.
Page 19 of 23