Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects a single Azure identity accessing three or more distinct Azure resource types within a short time window. This behavior can indicate an attacker attempting to enumerate or pivot through an environment after compromising an identity.
Detects suspicious child processes spawned by gup.exe, which is the Notepad++ updater. This behavior can indicate an attempt to hijack the update process for malicious purposes, such as executing arbitrary code or installing unwanted software. The rule specifically looks for gup.exe spawning common scripting/execution tools (update.exe, AutoUpdater.exe, curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe) or processes from temporary or user application data directories, while excluding legitimate explorer.exe and Notepad++ installer processes.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
Detects obfuscated PowerShell downloading 'script.ps1' from a suspected CrashFix C2 server (69.67.173.30) by identifying specific obfuscation patterns and download-related keywords in the PowerShell command line.
This rule detects when popular Remote Monitoring and Management (RMM) tools initiate network connections to public IP addresses. This behavior can be indicative of legitimate administrative tasks, but also of malicious activity where adversaries use these tools for remote access and control within a compromised environment. The rule specifically filters out connections to private IP ranges to reduce false positives related to internal network communication.
ClawdBot C2 Network Communication
Cortex XDR
Detects network connections to known malicious ClawdBot command and control (C2) infrastructure based on specific IP addresses and hostnames.
This rule detects the presence of known malicious file hashes associated with a weaponized ScreenConnect RAT campaign, specifically targeting a fake ClawdBot VS Code extension. It monitors file and process events for these specific SHA256 hashes.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
This rule correlates the deployment of ScreenConnect components (identified by specific process names and image paths) with subsequent network communication to a known ScreenConnect C2 server (meeting.bulletmailer.net on port 8041). It aims to detect suspicious ScreenConnect activity, potentially indicating unauthorized remote access or control.
Chrysalis Backdoor Network IOCs
Cortex XDR
Detects network connections to known command and control (C2) infrastructure associated with the Lotus Blossom threat group and the Chrysalis Backdoor. This rule identifies suspicious outbound network activity to specific IP addresses and hostnames linked to this threat actor.
Page 22 of 25