Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects the creation of a scheduled task named 'RageGuard' using the Windows schtasks.exe utility. This behavior is indicative of the TrymeLocker malware attempting to maintain persistence on a compromised system by executing with highest privileges upon user logon.
Detects modifications to the Windows registry key 'DisableTaskMgr' within the 'Policies\System' hive. Adversaries, including the TrymeLocker malware, may perform this action to prevent users from terminating malicious processes using the Task Manager.
This rule detects potential persistence mechanisms on Windows systems where a registry run key is configured to launch an executable associated with the RageCore malware or win_guard utility. It monitors for the creation or modification of registry entries within the Windows Run registry keys that reference these specific strings.
Detects the initialization of an Android package installation session using the 'PackageInstaller.createSession' API in conjunction with 'PackageInstaller$SessionParams'. This behavior is indicative of potential silent second-stage APK installation, a technique used by malicious applications to bypass standard installation prompts or deploy additional malicious components.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects a non-browser process creating a remote thread with a LoadLibraryW start function targeting chrome.exe, msedge.exe, or brave.exe, which is indicative of a suspend-inject-resume technique used to load unauthorized DLLs into a browser process, potentially bypassing browser protections such as App-Bound Encryption.
Detects instances where a process attempts to access the memory or control flow of a web browser (Chrome, Edge, Brave) using suspicious access rights (0x820), which correspond to PROCESS_VM_WRITE (allowing memory modification) and PROCESS_SUSPEND_RESUME (allowing thread suspension). This behavior is often indicative of process injection or hollowed execution attempts against browser processes.
Detects the deletion of files within the 'Temp\ffox_' directory on Windows systems, a behavior associated with the WEES stealer malware for anti-forensics during the cleanup of staged exfiltration data.
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Detects modifications to the 'StubPath' registry value within the 'Active Setup\Installed Components' registry hive. Adversaries use this mechanism to achieve persistence by forcing the execution of arbitrary code when a user logs in.
Page 22 of 23