Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects file system operations targeting common user directories and specific file extensions (.bak, .backup, .locked) often associated with data exfiltration, staging, or ransomware activity.
Detects unauthorized access to Chrome and Microsoft Edge login data files. This behavior is indicative of credential theft, frequently observed in info-stealer malware such as Stealer/1.0, which attempts to extract stored browser credentials for exfiltration.
Detects attempts to stop or reconfigure critical Windows security services (such as WinDefend, WscSvc, Sense, and WdNisSvc) using the Service Control Manager (sc.exe) or by modifying service registry keys via reg.exe. This behavior is indicative of an adversary attempting to disable EDR/AV solutions to evade detection.
Detects the modification of the Print Spooler (Spooler) Windows service configuration via command-line registry utilities (reg.exe or regedit.exe). This activity may indicate an attempt to restore or re-enable the Print Spooler service, which is frequently targeted for disabling as a mitigation strategy against vulnerabilities like PrintNightmare.
Detects potential anti-forensic activities performed by malware, specifically the use of 'attrib.exe' to hide files and 'cmd.exe' with 'del /f /q' to forcibly remove dropped payloads. These actions are common indicators of a cleanup phase in a malware lifecycle to hinder analysis.
Detects the use of reg.exe to modify a Windows Run registry key to execute a destructive 'format C:' command upon system startup, indicative of wiper-style malware activity.
Detects the use of reg.exe to create persistence via Windows Registry Run or RunOnce keys using specific naming conventions commonly associated with Stealer/1.0 malware (e.g., SystemUpdate, SystemCheck) targeting files located in the Downloads directory.
Detects the creation of an executable file named 'stealer.exe' within the Windows Startup folder. This activity is indicative of the Stealer/1.0 malware establishing persistence, ensuring execution upon user logon.
Detects the modification of a Windows Registry Run key using reg.exe to schedule a forced system shutdown. This pattern is often associated with wipers or disruptive malware attempting to ensure system unavailability upon reboot or login.
Detects the execution of JavaScript files using Windows Script Host (wscript.exe or cscript.exe) containing specific obfuscated patterns or indicators typically associated with malicious multi-stage dropper payloads. These patterns are indicative of obfuscated code attempting to evade static analysis and security controls during the initial execution phase.
Page 7 of 23