Ravi Asakapalli
@RavishankaraskpCompletionist
0 followers8 downloads46 copies3 likes3,224 views
10 detections
Filters
Last updated
All Time
Detection languages
10
Categories
5
3
3
2
2
Platforms
7
3
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
6
5
2
2
2
Detects persistence mechanisms installed by the trojanized Claude Code extension: macOS LaunchAgent plists, Windows scheduled tasks or Startup scripts, and Event ID 4698 scheduled task creation, when created by Node.js, Electron, Cursor, or VS Code processes
Detects installation or execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets).
Detects network connections to known suspicious domains or IP addresses
Detects variable splitting technique in cmd.exe to obfuscate PowerShell invocation.
Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning.
Detects files with paths matching known malicious extension IDs
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation