Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects instances where the Windows Script Host (wscript.exe) spawns a process to open a PDF file located within the Public user's 'Temp Documents' directory. This behavior is indicative of a potential malware staging or execution attempt where an adversary attempts to open a malicious document from a publicly accessible folder to bypass user suspicion or execute malicious content.
Detects VBScript droppers that utilize excessive 'WScript.Sleep' delays to bypass sandbox analysis, often combined with error suppression and downloader APIs to execute malicious payloads.
Detects mass file renaming activity associated with OpnKey ransomware, which appends specific ransom identifiers to files. This behavior is indicative of the encryption phase of a ransomware attack, where files are renamed to reflect the encryption status or to include a unique victim identifier.
Detects the use of the native Windows utility 'wbadmin.exe' to delete the system backup catalog or system state backups. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery by preventing administrators from restoring data from existing backups.
Detects the execution of batch files named 'db.bat' or 'adb.bat' from the Windows User Temp directory using cmd.exe. This activity is a known indicator of the OpnKey ransomware, which utilizes these scripts to facilitate its operations.
Detects the use of the Windows schtasks utility to delete a scheduled task named 'Windows Update'. This pattern is associated with OpnKey ransomware, which attempts to remove legitimate or potentially competing tasks to maintain persistence or avoid detection.
Detects the deletion of a file named 'Config.ini', a behavior associated with the OpnKey ransomware for cleaning up configuration artifacts after its execution cycle.
Detects the use of net.exe to stop critical system services commonly associated with ransomware operations, such as volume shadow copies, security services, and Windows update services, to facilitate data encryption or prevent system recovery.
Detects the presence of OpnKey ransomware-specific configuration strings related to size-tiered file encryption settings in process command lines. These indicators suggest the execution of a binary with hardcoded logic to categorize files for encryption based on their size.
Detects malicious command-line activity associated with the XHOPELESS v1.0 wiper, specifically targeting firmware/BIOS/UEFI integrity. The detection covers WMI-based corruption of BIOS attributes, abuse of OEM-specific BIOS management namespaces, execution of legitimate firmware update tools with suspicious flags, modification of registry keys intended to disable firmware updates, and interaction with specific UEFI NVRAM GUIDs.
Page 3 of 23