Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects command-line execution containing 'Processes.KillRunningProcesses', a string characteristic of the OpnKey ransomware builder configuration, suggesting an intent to terminate critical processes to facilitate encryption.
Detects command-line execution patterns indicative of OpnKey ransomware host fingerprinting. The ransomware gathers system metadata, including system IDs, PC hostnames, domain information, Windows versions, and processor names, likely to profile the environment prior to encryption or exfiltration.
Detects usage of the Windows API function GetUserObjectInformationW to inspect the current window station for specific strings, such as 'Service-0x'. This technique is often used by malware for environmental awareness, specifically to detect if it is running within a virtual machine or analysis sandbox by checking window station object attributes.
Detects the presence of OpnKey ransomware-specific configuration strings related to size-tiered file encryption settings in process command lines. These indicators suggest the execution of a binary with hardcoded logic to categorize files for encryption based on their size.
Detects attempts to tamper with or destroy Windows Boot Configuration Data (BCD) using bcdedit.exe to weaken system security policies or registry-based deletion of the BCD store to inhibit system boot and recovery.
Detects the creation or modification of Registry values under 'Image File Execution Options' (IFEO) that register a debugger for common administrative or diagnostic tools (e.g., Task Manager, Registry Editor, PowerShell). This technique can be used by malicious actors like XHOPELESS to intercept, block, or hijack the execution of legitimate tools, often to maintain persistence or impair security analysis.
Detects modifications to the Winlogon Shell or Userinit registry keys. These keys are commonly used by adversaries for persistence to execute malicious binaries or scripts upon user logon.
This rule detects the creation of scheduled tasks using names that masquerade as legitimate update services for Microsoft Edge, OneDrive, or Windows. Adversaries often use these names to hide persistence mechanisms within the Task Scheduler to maintain system access.
Detects the clearing of Windows event logs using the native 'wevtutil.exe' command or the PowerShell 'Clear-EventLog' cmdlet. This activity is commonly associated with anti-forensic techniques used by threat actors and wiper malware to obstruct incident response efforts and remove traces of malicious activity.
Detects attempts by processes to query Windows Registry keys that store configuration data for virtualization software like VMware and Oracle VirtualBox. This behavior is commonly used by malware to detect if it is running within an analysis environment to evade detection.
Page 5 of 23