Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Detects cmd.exe executing a ping-based delay to loopback followed by self-deletion of the batch script (%~f0), as well as bulk deletion of common archive and executable files, typically associated with malware droppers like RareWolf.
Detects Trays.exe started with the -tray argument from a Trays subfolder or a batch script, as observed in the RareWolf BAT dropper ahead of a silent AnyDesk installation.
Detects the archiving of the ProgramData AnyDesk directory using WinRAR/RAR with header encryption or the PowerShell Compress-Archive function, which indicates configuration staging for potential exfiltration.
Detects the execution of VBScript files that use a double extension (.pdf.vbs) via Windows Script Host (wscript.exe or cscript.exe). This technique is commonly used to masquerade malicious scripts as benign PDF documents to deceive users into executing them.
Detects the deletion of a specific file named 'Evernote.zip' located within the 'C:\Users\Public\' directory when executed by Windows Script Host (wscript.exe or cscript.exe). This activity is often associated with the cleanup of second-stage archives used during malicious operations.
Detects the execution of Windows Script Host (WScript.exe or CScript.exe) that creates a file or folder starting with 'Libs_' within the 'C:\Users\Public\' directory. This activity is often associated with attackers staging payloads, configuration files, or tools in publicly writable folders to evade detection.
Detects suspicious file activity where a script or process creates a staging folder within 'C:\Users\Public\' and subsequently writes potential decoy PDF files or compressed archive payloads to that same directory. This behavior is indicative of a dropper or secondary stage malware delivery mechanism utilizing world-writable directories for staging.
Detects instances where the Notepad++ executable is launched from a location within the C:\Users\Public\ directory, specifically when the parent process is a Windows scripting engine (wscript.exe or cscript.exe). This pattern is often indicative of an adversary executing a malicious payload staged in a common public directory using script-based wrappers to bypass execution policy or maintain stealth.
This rule detects instances where Windows script hosts (wscript.exe or cscript.exe) create directories with suspicious naming conventions (starting with 'Libs_' or containing 'Temp Documents') within the 'C:\Users\Public\' directory. This activity is often associated with the staging of malicious payloads or collected data prior to exfiltration or execution.
Page 2 of 23