Keith Dixon
@DetectionsAndDrumsMichiganCompletionist
0 followers186 downloads14 copies3 likes250 views
7 detections
Filters
Last updated
All Time
Detection languages
7
Categories
2
1
1
1
Platforms
3
1
1
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
Detects outbound network connections directly initiated by Windows system processes known to be Xctdoor injection targets (explorer.exe, ApplicationFrameHost.exe, RuntimeBroker.exe, sihost.exe, taskhostw.exe). Serves as the practical host-log proxy for screen capture, keylogging, clipboard theft, and reconnaissance-data exfiltration -- backdoor capabilities exercised entirely via in-process API calls with no distinct artifact of their own.
Detects creation of or connection to the \\.\Pipe\ChromeUpdatePipe named pipe used by CRAT's co-installed injector module to deliver payloads for process injection into a legitimate process.
Detects cmd.exe spawned as a child of a Windows system process known to be an Xctdoor injection target, consistent with the backdoor's interactive shell and multi-command execution capability run via 'cmd /c' from inside the injected process.
No description available.
Detects unauthorized modifications to the core npm CLI entry point file (cli.js). Adversaries may modify this file to inject malicious code, achieving persistence or executing unauthorized commands whenever the npm tool is invoked.
No description available.
No description available.