Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects the mass termination of processes related to productivity suites (Office, Thunderbird), database management (SQL, Oracle, MySQL, Postgres), system backups (VSS), and security monitoring/analysis tools (Task Manager, Wireshark, Process Explorer/Monitor). This activity is highly suspicious and may indicate an attacker attempting to disrupt services, hinder analysis, or prepare a host for destructive activities like data encryption or deletion.
Detects mass file deletion events within a one-minute window, which may indicate the use of secure deletion tools (such as those observed in LIUSHEN campaigns) or other unauthorized data destruction activities designed to remove forensic artifacts.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects unauthorized usage of the Android AccessibilityService 'performGlobalAction' to trigger a 'BACK' operation specifically when the Android Settings application is active. This behavior is indicative of malicious applications attempting to obstruct user attempts to reach the Settings menu to uninstall a malicious package.
Detects the use of foreground services and WakeLock mechanisms on Android, which can be leveraged by malicious applications like PromptSpy to maintain persistence and prevent the application from being terminated by the system.
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
Detects the creation of specific shortcut files (.lnk) or the use of WScript.Shell and CreateShortcut methods within PowerShell, associated with the VILE ransomware's fake decryptor lure technique.
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Detects the creation of a Windows service named 'RageService' using the sc.exe utility, potentially involving associated binary names like 'RageCore_' or 'win_guard_'. This activity is indicative of persistence mechanisms used by malware or unauthorized tools.
Detects modifications to the AppInit_DLLs or LoadAppInit_DLLs registry values. These values are used to force the loading of specified DLLs into every process that loads user32.dll, a technique used by adversaries for persistence and code injection.
Page 20 of 23