Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects modifications to the 'BootExecute' registry value within the 'Session Manager' key. The 'BootExecute' value, typically set to 'autocheck autochk *', controls programs that execute automatically during the Windows boot process. Adversaries can add arbitrary executables or scripts to this multi-string value to achieve persistence and gain code execution before user logon.
Detects the modification of the 'NoLogOff' registry value under the Windows Explorer policies key. This policy, when enabled, prevents the 'Log Off' option from appearing in the Start menu, which may be an attempt by an adversary to impair user sessions or lock a user into a specific session on a compromised host.
Detects modifications to the Windows Registry 'Winlogon\Userinit' key where the value contains double commas. This pattern is commonly used by attackers to append a malicious executable or script path to the legitimate 'userinit.exe' process, causing the malicious code to execute during every system startup or user logon.
Detects the modification of the 'NoFind' registry value within the 'Policies\Explorer' key, which is used to disable the Windows Search functionality for users. Adversaries or unauthorized users may modify this setting to impair system search capabilities or as part of a broader system hardening or lockdown policy.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
Detects specific persistence artifacts associated with LARP53RAT, including unauthorized file shortcuts in the Startup folder, modifications to RunOnce registry keys for system recovery, and suspicious scheduled task creation masquerading as Microsoft Edge updates.
Detects the creation or connection to a named pipe containing the string 'ChromeAppBoundVIP', a behavior associated with the WEES stealer malware for extracting sensitive information from web browsers.
Detects rapid file renaming of user-critical documents and media files to an .encrypted extension, indicative of mass file encryption activity typically associated with ransomware.
Detects the execution of the Snowlight dropper (wusvc.exe) masquerading as a Windows Update service. The rule identifies instances where wusvc.exe is spawned by services.exe from an unconventional path, signaling a potential malicious service installation associated with the UNC5221 VSHELL RAT campaign. The payload is known to utilize Hell's Gate/Halo's Gate direct syscall techniques to evade security API hooks.
Page 21 of 23