Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads774 copies15 likes20,585 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects svchost.exe (hosting Windows Store Install Service) loading InstallServicePlugin.dll from a UNC path or making outbound SMB connections as NT AUTHORITY\SYSTEM. This indicates successful UNCanny coercion where the SYSTEM-level service performs LoadLibraryW against an attacker-controlled UNC path, enabling NTLM machine account capture or SYSTEM code execution.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Identifies instances where curl is used to interact with a mounted Docker Unix socket. This technique is used to issue API commands directly to the Docker daemon, often to deploy new privileged containers for host escape.
Detects file execution where curl.exe or bitsadmin.exe are copied to a public document folder and renamed to DLL extensions (like winhttp.dll or wininet.dll) to evade detection. This activity is associated with the TAX#TRIDENT campaign.
Detects execution of svchost.exe from the non-standard \Windows\SysWOW64\msres\ folder. This behavior is associated with the ClientSetup/SyncFuture payload used in the TAX#TRIDENT campaign to maintain C2 sessions.
Detects the creation or modification of YTSysConfig.ini or YTSysConfig.ytf, which are runtime configuration files for the ClientSetup/Yangtu payload used in the TAX#TRIDENT campaign. This activity indicates potential deployment or configuration of the malware.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Page 3 of 13