Subhankar H
@Andrewsec57RemoteTrusted contributorCompletionist
0 followers2,502 downloads174 copies3 likes1,967 views
222 detections
Filters
Last updated
All Time
Detection languages
221
1
Categories
93
47
32
22
21
Platforms
178
8
6
3
1
Products / Services
142
64
24
7
7
MITRE Techniques
75
54
44
43
24
Detects instances where the Google Chrome browser is executed with flags that disable the sandbox security feature, such as --no-sandbox and --allow-no-sandbox-job. This configuration is often used by adversaries to facilitate credential dumping from the browser by bypassing sandbox restrictions that typically prevent unauthorized process memory access.
Detects command-line activity indicative of stealer malware behavior, specifically the construction of victim fingerprinting strings by querying environment variables such as computer name, username, disk size, and RAM capacity. This behavior is commonly associated with initial reconnaissance phases of information-stealing malware.
This rule detects the execution of 'vlc.exe' or loading of 'libvlc.dll' from common staging or user-writable directories such as Temp, Downloads, or Desktop. This pattern is commonly associated with adversary efforts to execute masquerading or portable malicious payloads, as legitimate VLC installations are typically located in Program Files.
Detects the execution of JavaScript files using WScript or CScript that contain obfuscated 'eval()' calls, such as string concatenation (e.g., (0,this)["ev"+"al"]) or Unicode escaping. Adversaries often use these techniques to bypass signature-based detection for malicious script execution.
This rule detects the creation of files with specific names '8bfa.zip' or '8bfa.bin' within the Windows AppData Local Temp directory. This behavior is indicative of a threat actor staging payloads or tools on a compromised system, typically as a precursor to execution or lateral movement.
Detects read access to the Windows Registry keys associated with Outlook profile SMTP passwords. Attackers may attempt to extract these credentials to gain unauthorized access to email accounts.
Detects file system access to the ProtonVPN local configuration directory. This directory may contain sensitive data, such as cached credentials or session information, which could be targeted by unauthorized actors to facilitate credential theft or session hijacking.
Detects the creation of a registry RunOnce key pointing to an executable named 'vlc.exe' located within a user's temporary directory. This pattern is commonly associated with persistence mechanisms where malware masquerades as a legitimate application to gain execution upon user login.
Detects file access events targeting the Mozilla Thunderbird profile directory on Windows systems, which may indicate unauthorized collection or theft of local email data, archives, and account configuration files.
Detects the deletion of specific staging files (8bfa.zip or 8bfa.bin) within the Windows user's local Temp directory, often associated with adversary cleanup activities after staging data or tools.
Page 8 of 23