Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects modifications to Windows Registry keys intended to disable System Restore, User Account Control (UAC), or automatic Windows Updates, which is indicative of an attacker attempting to impair system defenses or inhibit recovery capabilities.
Detects the creation of ransom notes by the OpnKey ransomware family, which specifically uses the filename #Restore-My-Files.txt. This file is a characteristic indicator of the ransomware's post-encryption activity.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to force an immediate reboot (/r /t 0 /f). This behavior is often associated with disruptive activities or attempts to clear system state by unauthorized actors.
Detects the XHOPELESS wiper routine 'KillNetworkPermanent' which severs network connectivity by resetting the TCP/IP stack using netsh, blocking all traffic via Windows Advanced Firewall commands, and disabling network adapters via devcon.exe as a final destructive action.
Detects the deletion of registry keys associated with Windows SafeBoot configuration. Adversaries may delete these keys to disrupt system recovery mechanisms, preventing administrators from booting the system into Safe Mode to diagnose or remove malicious software.
Detects the use of living-off-the-land binaries such as mshta.exe, wmic.exe, and rundll32.exe to execute commands or code indirectly. This technique is often used to bypass security restrictions that might prevent the direct execution of common command-line interpreters.
Detects the deletion of the XHOPELESS wiper executable from the filesystem, a technique commonly used by malware to remove its own traces and hinder forensic analysis after execution.
Detects the use of bcdedit.exe to disable automatic system recovery features, a common technique used by ransomware and other malware to prevent automated restoration of the operating system after compromise.
Detects the creation of a scheduled task named 'Windows Update ALPHV' using the schtasks.exe utility. This task is associated with the OpnKey ransomware, which uses this name to masquerade as a legitimate Windows Update task while running with SYSTEM privileges to maintain persistence.
Detects the execution of vssadmin.exe or WMIC.exe with commands intended to delete Volume Shadow Copies. This behavior is commonly associated with ransomware attempting to prevent system restoration by deleting local backups.
Page 4 of 23