Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects direct file access attempts to critical Windows registry hive files (SAM, SECURITY, SYSTEM, SOFTWARE) on disk. These files contain sensitive system and credential information, and direct access is frequently used by adversaries to perform offline credential dumping.
Detects the use of the Windows 'diskpart' utility combined with a script or command execution containing 'clean all', which performs a destructive multi-pass overwrite of disk data structures to render it irrecoverable. This behavior is typically associated with malicious data destruction or wiping activities.
Detects persistence attempts via the 'BootExecute' registry value hijack and identifies specific file system paths associated with XHOPELESS malware infection markers. This rule alerts on unauthorized modifications to the session manager startup configuration or the presence of known infection indicators.
Detects a process enabling multiple sensitive Windows privileges simultaneously via a single AdjustTokenPrivileges event (Event ID 4703). This behavior is characteristic of malicious tools, such as the XHOPELESS wiper, attempting to gain broad system control for activities like tampering with firmware, killing protected processes, loading malicious drivers, or modifying boot configurations.
Detects a sequence of commands characteristic of the Stealer/1.0 malware, involving the systematic disabling of security features including Windows Defender, Firewall, UAC, System Restore, Windows Recovery Environment, SafeBoot, and the deletion of Volume Shadow Copies as a precursor to destructive data operations.
Detects the execution of vssadmin.exe to delete volume shadow copies or attempts to clear recovery-related directories such as SoftwareDistribution or Windows.old. This behavior is indicative of ransomware or destructive activity aimed at inhibiting system recovery.
Detects the use of 'bootsect.exe' with parameters specifically designed to overwrite the Master Boot Record (MBR) and the targeting or modification of 'winload.efi', which is indicative of destructive boot-level attacks or bootkit deployment attempts.
Detects the use of the 'netsh wlan show profile' command with the 'key=clear' argument, which is used to display the plaintext passwords of stored WiFi profiles on a Windows system.
This rule detects unauthorized modification of the desktop wallpaper registry key to an empty string, typically used for desktop defacement or disruptive activity, followed by a system parameter refresh to apply the changes immediately. It monitors for the use of reg.exe to clear the wallpaper registry value and rundll32.exe to invoke the User32.dll UpdatePerUserSystemParameters function, which forces the Windows shell to refresh desktop settings.
Detects access to sensitive credential and configuration files commonly used by developers and automated systems, such as AWS credentials, SSH keys, Docker configurations, NPM tokens, and Maven settings. Access to these files is a high-indicator of credential harvesting by malicious actors or stealer-type malware.
Page 6 of 23